nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS, $manager, $member;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet*/\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 \r
 169                 /* NOTE: 2. make an instance of skin object */\r
 170                 if ( !Skin::existsID($skinid) )\r
 171                 {\r
 172                         return FALSE;\r
 173                 }\r
 174                 \r
 175                 /* NOTE: 3. initializing each members */\r
 176                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 177                 self::$action           = '';\r
 178                 self::$extrahead        = '';\r
 179                 self::$passvar          = '';\r
 180                 self::$headMess         = '';\r
 181                 self::$aOptions         = '';\r
 182                 return TRUE;\r
 183         }\r
 184         \r
 185         /**\r
 186          * Admin::action()\r
 187          * Executes an action\r
 188          *\r
 189          * @param       string  $action action to be performed\r
 190          * @return      void\r
 191          */\r
 192         static public function action($action)\r
 193         {\r
 194                 global $CONF, $DIR_LIBS, $manager, $member;\r
 195                 \r
 196                 /* 1. decide action name */\r
 197                 $customAction = postvar('customaction');\r
 198                 if ( !empty($customAction) )\r
 199                 {\r
 200                         $alias = array(\r
 201                                 'login' => $customAction,\r
 202                                 ''              => $customAction\r
 203                         );\r
 204                 }\r
 205                 else\r
 206                 {\r
 207                         $alias = array(\r
 208                                 'login' => 'overview',\r
 209                                 ''              => 'overview',\r
 210                         );\r
 211                 }\r
 212                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 213                 {\r
 214                         $action = $alias[$action];\r
 215                 }\r
 216                 $methodName = "action_{$action}";\r
 217                 self::$action = strtolower($action);\r
 218                 \r
 219                 /* 2. check the action */\r
 220                 $synonimActions = array(\r
 221                         'banlistnewfromitem',\r
 222                         'memberedit',\r
 223                         'login',\r
 224                 );\r
 225                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 226                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 227                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 228                 {\r
 229                         if (!$manager->checkTicket())\r
 230                         {\r
 231                                 self::error(_ERROR_BADTICKET);\r
 232                         }\r
 233                 }\r
 234                 \r
 235                 /* 3. parse according to the action */\r
 236                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 237                 {\r
 238                         /* TODO: what is this?\r
 239                         self::action_parseSpecialskin();\r
 240                         */\r
 241                 }\r
 242                 elseif ( method_exists('Admin', $methodName) )\r
 243                 {\r
 244                         call_user_func(array(__CLASS__, $methodName));\r
 245                 }\r
 246                 else if ( self::existsSkinContents('adminerrorpage') )\r
 247                 {\r
 248                         self::error(_BADACTION . ENTITY::hsc($action));\r
 249                 }\r
 250                 elseif ( $id != $CONF['AdminSkin'] )\r
 251                 {\r
 252                         self::$skin =& $manager->getSkin($CONF['AdminSkin'], 'AdminActions');\r
 253                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 254                         {\r
 255                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 256                         }\r
 257                 }\r
 258                 else\r
 259                 {\r
 260                         self::error(_BADACTION . ENTITY::hsc($action));\r
 261                 }\r
 262                 exit;\r
 263         }\r
 264         \r
 265         /**\r
 266          * Action::existsSkinContents()\r
 267          * Check skin contents\r
 268          *\r
 269          * @param       string  $action action type\r
 270          * @return      boolean\r
 271          */\r
 272         static private function existsSkinContents($action)\r
 273         {\r
 274                 $in_array  = in_array($action, self::$skinless_actions);\r
 275                 \r
 276                 if ( $in_array )\r
 277                 {\r
 278                         return $in_array;\r
 279                 }\r
 280                 else\r
 281                 {\r
 282                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 283                         /* TODO: skinid should be a default */\r
 284                         if ( !is_object(self::$skin) )\r
 285                         {\r
 286                                 global $CONF;\r
 287                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 288                         }\r
 289                         else\r
 290                         {\r
 291                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 292                         }\r
 293                 }\r
 294                 return;\r
 295         }\r
 296         \r
 297         /**\r
 298          * Action::specialActionsAllow()\r
 299          * Check exists specialskinparts\r
 300          *\r
 301          * @param       string  $action action type\r
 302          * @return boolean\r
 303          */\r
 304         static private function specialActionsAllow($action)\r
 305         {\r
 306                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 307                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 308                 return DB::getValue($query);\r
 309         }\r
 310         \r
 311         /**\r
 312          * Action::action_showlogin()\r
 313          * \r
 314          * @param       void\r
 315          * @return      void\r
 316          */\r
 317         static private function action_showlogin()\r
 318         {\r
 319                 global $error;\r
 320                 self::action_login($error);\r
 321                 return;\r
 322         }\r
 323         \r
 324         /**\r
 325          * Action::action_login()\r
 326          * \r
 327          * @param       string  $msg            message for pageheader\r
 328          * @param       integer $passvars       ???\r
 329          */\r
 330         static private function action_login($msg = '', $passvars = 1)\r
 331         {\r
 332                 global $member;\r
 333                 \r
 334                 // skip to overview when allowed\r
 335                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 336                 {\r
 337                         self::action_overview();\r
 338                         exit;\r
 339                 }\r
 340                 \r
 341                 /* TODO: needless variable??? */\r
 342                 self::$passvar = $passvars;\r
 343                 if ( $msg )\r
 344                 {\r
 345                         self::$headMess = $msg;\r
 346                 }\r
 347                 \r
 348                 self::$skin->parse('showlogin');\r
 349         }\r
 350         \r
 351         /**\r
 352          * Action::action_overview()\r
 353          * provides a screen with the overview of the actions available\r
 354          * \r
 355          * @param       string  $msg    message for pageheader\r
 356          * @return      void\r
 357          */\r
 358         static private function action_overview($msg = '')\r
 359         {\r
 360                 if ( $msg )\r
 361                 {\r
 362                         self::$headMess = $msg;\r
 363                 }\r
 364                 \r
 365                 self::$skin->parse('overview');\r
 366                 return;\r
 367         }\r
 368         \r
 369         /**\r
 370          * Admin::action_manage()\r
 371          * \r
 372          * @param       string  $msg    message for pageheader\r
 373          * @retrn       void\r
 374          */\r
 375         static private function action_manage($msg = '')\r
 376         {\r
 377                 global $member;\r
 378                 \r
 379                 if ( $msg )\r
 380                 {\r
 381                         self::$headMess = $msg;\r
 382                 }\r
 383                 $member->isAdmin() or self::disallow();\r
 384                 \r
 385                 self::$skin->parse('manage');\r
 386                 return;\r
 387         }\r
 388         \r
 389         /**\r
 390          * Action::action_itemlist()\r
 391          * \r
 392          * @param       integer id for weblod\r
 393          * @return      void\r
 394          */\r
 395         static private function action_itemlist($blogid = '')\r
 396         {\r
 397                 global $member, $manager, $CONF;\r
 398                 \r
 399                 if ( $blogid == '' )\r
 400                 {\r
 401                         $blogid = intRequestVar('blogid');\r
 402                 }\r
 403                 \r
 404                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 405                 \r
 406                 self::$skin->parse('itemlist');\r
 407                 return;\r
 408         }\r
 409         \r
 410         /**\r
 411          * Action::action_batchitem()\r
 412          * \r
 413          * @param       void\r
 414          * @return      void\r
 415          */\r
 416         static private function action_batchitem()\r
 417         {\r
 418                 global $member, $manager;\r
 419                 \r
 420                 $member->isLoggedIn() or self::disallow();\r
 421                 \r
 422                 $selected       = requestIntArray('batch');\r
 423                 $action         = requestVar('batchaction');\r
 424                 \r
 425                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 426                 {\r
 427                         self::error(_BATCH_NOSELECTION);\r
 428                 }\r
 429                 \r
 430                 // On move: when no destination blog/category chosen, show choice now\r
 431                 $destCatid = intRequestVar('destcatid');\r
 432                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 433                 {\r
 434                         self::batchMoveSelectDestination('item', $selected);\r
 435                 }\r
 436                 \r
 437                 // On delete: check if confirmation has been given\r
 438                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 439                 {\r
 440                         self::batchAskDeleteConfirmation('item', $selected);\r
 441                 }\r
 442                 \r
 443                 self::$skin->parse('batchitem');\r
 444                 return;\r
 445         }\r
 446         \r
 447         /**\r
 448          * Action::action_batchcomment()\r
 449          * \r
 450          * @param       void\r
 451          * @return      void\r
 452          */\r
 453         static private function action_batchcomment()\r
 454         {\r
 455                 global $member;\r
 456                 \r
 457                 $member->isLoggedIn() or self::disallow();\r
 458                 \r
 459                 $selected       = requestIntArray('batch');\r
 460                 $action         = requestVar('batchaction');\r
 461                 \r
 462                 // Show error when no items were selected\r
 463                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 464                 {\r
 465                         self::error(_BATCH_NOSELECTION);\r
 466                 }\r
 467                 \r
 468                 // On delete: check if confirmation has been given\r
 469                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 470                 {\r
 471                         self::batchAskDeleteConfirmation('comment', $selected);\r
 472                 }\r
 473                 \r
 474                 self::$skin->parse('batchcomment');\r
 475                 return;\r
 476         }\r
 477         \r
 478         /**\r
 479          * Admin::setAdminAction()\r
 480          *\r
 481          * @param       string  $action\r
 482          * @return      void\r
 483          */\r
 484         static public function setAdminAction($action)\r
 485         {\r
 486                 self::$action = $action;\r
 487                 return;\r
 488         }\r
 489         \r
 490         /**\r
 491          * Admin::action_batchmember()\r
 492          * \r
 493          * @param       void\r
 494          * @return      void\r
 495          */\r
 496         static private function action_batchmember()\r
 497         {\r
 498                 global $member;\r
 499                 \r
 500                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 501                 \r
 502                 $selected       = requestIntArray('batch');\r
 503                 $action         = requestVar('batchaction');\r
 504                 \r
 505                 // Show error when no members selected\r
 506                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 507                 {\r
 508                         self::error(_BATCH_NOSELECTION);\r
 509                 }\r
 510                 \r
 511                 // On delete: check if confirmation has been given\r
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 513                 {\r
 514                         self::batchAskDeleteConfirmation('member',$selected);\r
 515                 }\r
 516                 \r
 517                 self::$skin->parse('batchmember');\r
 518                 return;\r
 519         }\r
 520         \r
 521         /**\r
 522          * Admin::action_batchteam()\r
 523          * \r
 524          * @param       void\r
 525          * @return      void\r
 526          */\r
 527         static private function action_batchteam()\r
 528         {\r
 529                 global $member;\r
 530                 \r
 531                 $blogid = intRequestVar('blogid');\r
 532                 \r
 533                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 534                 \r
 535                 $selected       = requestIntArray('batch');\r
 536                 $action         = requestVar('batchaction');\r
 537                 \r
 538                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 539                 {\r
 540                         self::error(_BATCH_NOSELECTION);\r
 541                 }\r
 542                 \r
 543                 // On delete: check if confirmation has been given\r
 544                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 545                 {\r
 546                         self::batchAskDeleteConfirmation('team',$selected);\r
 547                 }\r
 548                 \r
 549                 self::$skin->parse('batchteam');\r
 550                 return;\r
 551         }\r
 552         \r
 553         /**\r
 554          * Admin::action_batchcategory()\r
 555          * \r
 556          * @param       void\r
 557          * @return      void\r
 558          */\r
 559         static private function action_batchcategory()\r
 560         {\r
 561                 global $member, $manager;\r
 562                 \r
 563                 $member->isLoggedIn() or self::disallow();\r
 564                 \r
 565                 $selected       = requestIntArray('batch');\r
 566                 $action         = requestVar('batchaction');\r
 567                 \r
 568                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 569                 {\r
 570                         self::error(_BATCH_NOSELECTION);\r
 571                 }\r
 572                 \r
 573                 // On move: when no destination blog chosen, show choice now\r
 574                 $destBlogId = intRequestVar('destblogid');\r
 575                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 576                 {\r
 577                         self::batchMoveCategorySelectDestination('category', $selected);\r
 578                 }\r
 579                 \r
 580                 // On delete: check if confirmation has been given\r
 581                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 582                 {\r
 583                         self::batchAskDeleteConfirmation('category', $selected);\r
 584                 }\r
 585                 \r
 586                 self::$skin->parse('batchcategory');\r
 587                 return;\r
 588         }\r
 589         \r
 590         /**\r
 591          * Admin::batchMoveSelectDestination()\r
 592          * \r
 593          * @param       string  $type   type of batch action\r
 594          * @param       integer $ids    needless???\r
 595          * @return      void\r
 596          * \r
 597          * TODO: remove needless argument\r
 598          */\r
 599         static private function batchMoveSelectDestination($type, $ids)\r
 600         {\r
 601                 $_POST['batchmove'] = $type;\r
 602                 self::$skin->parse('batchmove');\r
 603                 return;\r
 604         }\r
 605         \r
 606         /**\r
 607          * Admin::batchMoveCategorySelectDestination()\r
 608          * \r
 609          * @param       string  $type   type of batch action\r
 610          * @param       integer $ids    needless???\r
 611          * @return      void\r
 612          * \r
 613          * TODO: remove needless argument\r
 614          */\r
 615         static private function batchMoveCategorySelectDestination($type, $ids)\r
 616         {\r
 617                 $_POST['batchmove'] = $type;\r
 618                 global $manager;\r
 619                 self::$skin->parse('batchmovecat');\r
 620                 return;\r
 621         }\r
 622         \r
 623         /**\r
 624          * Admin::batchAskDeleteConfirmation()\r
 625          * \r
 626          * @param       string  $type   type of batch action\r
 627          * @param       integer $ids    needless???\r
 628          * @return      void\r
 629          * \r
 630          * TODO: remove needless argument\r
 631          */\r
 632         static private function batchAskDeleteConfirmation($type, $ids)\r
 633         {\r
 634                 self::$skin->parse('batchdelete');\r
 635                 return;\r
 636         }\r
 637         \r
 638         /**\r
 639          * Admin::action_browseownitems()\r
 640          * \r
 641          * @param       void\r
 642          * @return      void\r
 643          */\r
 644         static private function action_browseownitems()\r
 645         {\r
 646                 global $member, $manager, $CONF;\r
 647                 \r
 648                 self::$skin->parse('browseownitems');\r
 649                 return;\r
 650         }\r
 651         \r
 652         /**\r
 653          * Admin::action_itemcommentlist()\r
 654          * Show all the comments for a given item\r
 655          * \r
 656          * @param       integer $itemid ID for item\r
 657          * @return      void\r
 658          */\r
 659         static private function action_itemcommentlist($itemid = '')\r
 660         {\r
 661                 global $member, $manager, $CONF;\r
 662                 \r
 663                 if ( $itemid == '' )\r
 664                 {\r
 665                         $itemid = intRequestVar('itemid');\r
 666                 }\r
 667                 \r
 668                 // only allow if user is allowed to alter item\r
 669                 $member->canAlterItem($itemid) or self::disallow();\r
 670                 \r
 671                 $item =& $manager->getItem($itemid, 1, 1);\r
 672                 $_REQUEST['itemid'] = $item['itemid'];\r
 673                 $_REQUEST['blogid'] = $item['blogid'];\r
 674                 \r
 675                 self::$skin->parse('itemcommentlist');\r
 676                 return;\r
 677         }\r
 678         \r
 679         /**\r
 680          * Admin::action_browseowncomments()\r
 681          * Browse own comments\r
 682          * \r
 683          * @param       void\r
 684          * @return      void\r
 685          */\r
 686         static private function action_browseowncomments()\r
 687         {\r
 688                 self::$skin->parse('browseowncomments');\r
 689                 return;\r
 690         }\r
 691         \r
 692         /**\r
 693          * Admin::action_blogcommentlist()\r
 694          * Browse all comments for a weblog\r
 695          * \r
 696          * @param       integer $blogid ID for weblog\r
 697          * @return      void\r
 698          */\r
 699         static private function action_blogcommentlist($blogid = '')\r
 700         {\r
 701                 global $member, $manager, $CONF;\r
 702                 \r
 703                 if ( $blogid == '' )\r
 704                 {\r
 705                         $blogid = intRequestVar('blogid');\r
 706                 }\r
 707                 else\r
 708                 {\r
 709                         $blogid = intval($blogid);\r
 710                 }\r
 711                 \r
 712                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 713                 \r
 714                 /* TODO: we consider to use the other way insterad of this */\r
 715                 $_REQUEST['blogid'] = $blogid;\r
 716                 \r
 717                 self::$skin->parse('blogcommentlist');\r
 718                 return;\r
 719         }\r
 720         \r
 721         /**\r
 722          * Admin::action_createaccount()\r
 723          * \r
 724          * @param       void\r
 725          * @return      void\r
 726          */\r
 727         static private function action_createaccount()\r
 728         {\r
 729                 global $CONF;\r
 730                 \r
 731                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 732                 {\r
 733                         self::$skin->parse('createaccountdisable');\r
 734                         return;\r
 735                 }\r
 736                 \r
 737                 $name = '';\r
 738                 $realname ='';\r
 739                 $email = '';\r
 740                 $url = '';\r
 741                 \r
 742                 $contents = array(\r
 743                         'name'          => '',\r
 744                         'realname'      => '',\r
 745                         'email'         => '',\r
 746                         'url'           => ''\r
 747                 );\r
 748                 \r
 749                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 750                 {\r
 751                         $action = new Action();\r
 752                         $message = $action->createAccount();\r
 753                         if ( $message === 1 )\r
 754                         {\r
 755                                 self::$headMess = $message;\r
 756                                 self::$skin->parse('createaccountsuccess');\r
 757                                 return;\r
 758                         }\r
 759                         \r
 760                         /* TODO: validation */\r
 761                         if ( array_key_exists('name', $_POST) )\r
 762                         {\r
 763                                 $contents['name'] = $_POST['name'];\r
 764                         }\r
 765                         if ( array_key_exists('realname', $_POST) )\r
 766                         {\r
 767                                 $contents['realname'] = $_POST['realname'];\r
 768                         }\r
 769                         if ( array_key_exists('email', $_POST) )\r
 770                         {\r
 771                                 $contents['email'] = $_POST['email'];\r
 772                         }\r
 773                         if ( array_key_exists('url', $_POST) )\r
 774                         {\r
 775                                 $contents['url'] = $_POST['url'];\r
 776                         }\r
 777                         \r
 778                         self::$contents = $contents;\r
 779                         \r
 780                 }\r
 781                 \r
 782                 self::$skin->parse('createaccountinput');\r
 783                 return;\r
 784         }\r
 785         \r
 786         /**\r
 787          * Admin::action_createitem()\r
 788          * Provide a page to item a new item to the given blog\r
 789          * \r
 790          * @param       void\r
 791          * @return      void\r
 792          */\r
 793         static private function action_createitem()\r
 794         {\r
 795                 global $member, $manager;\r
 796                 \r
 797                 $blogid = intRequestVar('blogid');\r
 798                 \r
 799                 // check if allowed\r
 800                 $member->teamRights($blogid) or self::disallow();\r
 801                 \r
 802                 $blog =& $manager->getBlog($blogid);\r
 803                 $contents = array();\r
 804                 \r
 805                 $data = array(\r
 806                         'blog'          => &$blog,\r
 807                         'contents'      => &$contents\r
 808                 );\r
 809                 $manager->notify('PreAddItemForm', $data);\r
 810                 \r
 811                 if ( $blog->convertBreaks() )\r
 812                 {\r
 813                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 814                         {\r
 815                                 $contents['body'] = removeBreaks($contents['body']);\r
 816                         }\r
 817                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 818                         {\r
 819                                 $contents['more'] = removeBreaks($contents['more']);\r
 820                         }\r
 821                 }\r
 822                 \r
 823                 self::$blog = &$blog;\r
 824                 self::$contents = &$contents;\r
 825                 \r
 826                 self::$skin->parse('createitem');\r
 827                 return;\r
 828         }\r
 829         \r
 830         /**\r
 831          * Admin::action_itemedit()\r
 832          * \r
 833          * @param       void\r
 834          * @return      void\r
 835          */\r
 836         static private function action_itemedit()\r
 837         {\r
 838                 global $member, $manager;\r
 839                 \r
 840                 $itemid = intRequestVar('itemid');\r
 841                 \r
 842                 // only allow if user is allowed to alter item\r
 843                 $member->canAlterItem($itemid) or self::disallow();\r
 844                 \r
 845                 $item =& $manager->getItem($itemid, 1, 1);\r
 846                 $blog =& $manager->getBlog($item['blogid']);\r
 847                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 848                 \r
 849                 if ( $blog->convertBreaks() )\r
 850                 {\r
 851                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 852                         {\r
 853                                 $item['body'] = removeBreaks($item['body']);\r
 854                         }\r
 855                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 856                         {\r
 857                                 $item['more'] = removeBreaks($item['more']);\r
 858                         }\r
 859                 }\r
 860                 \r
 861                 self::$blog = &$blog;\r
 862                 self::$contents = &$item;\r
 863                 \r
 864                 self::$skin->parse('itemedit');\r
 865                 return;\r
 866         }\r
 867         \r
 868         /**\r
 869          * Admin::action_itemupdate()\r
 870          * \r
 871          * @param       void\r
 872          * @return      void\r
 873          */\r
 874         static private function action_itemupdate()\r
 875         {\r
 876                 global $member, $manager, $CONF;\r
 877                 \r
 878                 $itemid = intRequestVar('itemid');\r
 879                 $catid  = postVar('catid');\r
 880                 \r
 881                 // only allow if user is allowed to alter item\r
 882                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 883                 \r
 884                 $actiontype = postVar('actiontype');\r
 885                 \r
 886                 // delete actions are handled by itemdelete (which has confirmation)\r
 887                 if ( $actiontype == 'delete' )\r
 888                 {\r
 889                         self::action_itemdelete();\r
 890                         return;\r
 891                 }\r
 892                 \r
 893                 $body           = postVar('body');\r
 894                 $title          = postVar('title');\r
 895                 $more           = postVar('more');\r
 896                 $closed         = intPostVar('closed');\r
 897                 $draftid        = intPostVar('draftid');\r
 898                 \r
 899                 // default action = add now\r
 900                 if ( !$actiontype )\r
 901                 {\r
 902                         $actiontype='addnow';\r
 903                 }\r
 904                 \r
 905                 // create new category if needed\r
 906                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 907                 {\r
 908                         // get blogid\r
 909                         list($blogid) = sscanf($catid,"newcat-%d");\r
 910                         \r
 911                         // create\r
 912                         $blog =& $manager->getBlog($blogid);\r
 913                         $catid = $blog->createNewCategory();\r
 914                         \r
 915                         // show error when sth goes wrong\r
 916                         if ( !$catid )\r
 917                         {\r
 918                                 self::doError(_ERROR_CATCREATEFAIL);\r
 919                         }\r
 920                 }\r
 921                 \r
 922                 /**\r
 923                  * set some variables based on actiontype\r
 924                  * \r
 925                  * actiontypes:\r
 926                  *      draft items -> addnow, addfuture, adddraft, delete\r
 927                  *      non-draft items -> edit, changedate, delete\r
 928                  * \r
 929                  * variables set:\r
 930                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 931                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 932                  *      $publish: set to 1 when the edited item is not a draft\r
 933                  */\r
 934                 $blogid =  getBlogIDFromItemID($itemid);\r
 935                 $blog =& $manager->getBlog($blogid);\r
 936                 \r
 937                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 938                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 939                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 940                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 941                 {\r
 942                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 943                 }\r
 944                 else\r
 945                 {\r
 946                         $timestamp =0;\r
 947                 }\r
 948                 \r
 949                 // edit the item for real\r
 950                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 951                 \r
 952                 self::updateFuturePosted($blogid);\r
 953                 \r
 954                 if ( $draftid > 0 )\r
 955                 {\r
 956                         // delete permission is checked inside Item::delete()\r
 957                         Item::delete($draftid);\r
 958                 }\r
 959                 \r
 960                 if ( $catid != intPostVar('catid') )\r
 961                 {\r
 962                         self::action_categoryedit(\r
 963                                 $catid,\r
 964                                 $blog->getID(),\r
 965                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 966                         );\r
 967                 }\r
 968                 else\r
 969                 {\r
 970                         // TODO: set start item correctly for itemlist\r
 971                         $item =& $manager->getitem($itemid, 1, 1);\r
 972                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 973                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 974                         $cnt  = DB::getValue($query);\r
 975                         $_REQUEST['start'] = $cnt + 1;\r
 976                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 977                 }\r
 978                 return;\r
 979         }\r
 980         \r
 981         /**\r
 982          * Admin::action_itemdelete()\r
 983          * Delete item\r
 984          * \r
 985          * @param       Void\r
 986          * @return      Void\r
 987          */\r
 988         static private function action_itemdelete()\r
 989         {\r
 990                 global $member, $manager;\r
 991                 \r
 992                 $itemid = intRequestVar('itemid');\r
 993                 \r
 994                 // only allow if user is allowed to alter item\r
 995                 $member->canAlterItem($itemid) or self::disallow();\r
 996                 \r
 997                 if ( !$manager->existsItem($itemid,1,1) )\r
 998                 {\r
 999                         self::error(_ERROR_NOSUCHITEM);\r
1000                 }\r
1001                 \r
1002                 self::$skin->parse('itemdelete');\r
1003                 return;\r
1004         }\r
1005         \r
1006         /**\r
1007          * Admin::action_itemdeleteconfirm()\r
1008          * \r
1009          * @param       void\r
1010          * @return      void\r
1011          */\r
1012         static private function action_itemdeleteconfirm()\r
1013         {\r
1014                 global $member, $manager;\r
1015                 \r
1016                 $itemid = intRequestVar('itemid');\r
1017                 \r
1018                 // only allow if user is allowed to alter item\r
1019                 $member->canAlterItem($itemid) or self::disallow();\r
1020                 \r
1021                 // get item first\r
1022                 $item =& $manager->getItem($itemid, 1, 1);\r
1023                 \r
1024                 // delete item (note: some checks will be performed twice)\r
1025                 self::deleteOneItem($item['itemid']);\r
1026                 \r
1027                 self::action_itemlist($item['blogid']);\r
1028                 return;\r
1029         }\r
1030         \r
1031         /**\r
1032          * Admin::deleteOneItem()\r
1033          * Deletes one item and returns error if something goes wrong\r
1034          * \r
1035          * @param       integer $itemid ID for item\r
1036          * @return      void\r
1037          */\r
1038         static public function deleteOneItem($itemid)\r
1039         {\r
1040                 global $member, $manager;\r
1041                 \r
1042                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1043                 if ( !$member->canAlterItem($itemid) )\r
1044                 {\r
1045                         return _ERROR_DISALLOWED;\r
1046                 }\r
1047                 \r
1048                 // need to get blogid before the item is deleted\r
1049                 $item =& $manager->getItem($itemid, 1, 1);\r
1050                 \r
1051                 $manager->loadClass('ITEM');\r
1052                 Item::delete($item['itemid']);\r
1053                 \r
1054                 // update blog's futureposted\r
1055                 self::updateFuturePosted($item['itemid']);\r
1056                 return;\r
1057         }\r
1058         \r
1059         /**\r
1060          * Admin::updateFuturePosted()\r
1061          * Update a blog's future posted flag\r
1062          * \r
1063          * @param integer $blogid\r
1064          * @return      void\r
1065          */\r
1066         static private function updateFuturePosted($blogid)\r
1067         {\r
1068                 global $manager;\r
1069                 \r
1070                 $blogid                 =  intval($blogid);\r
1071                 $blog                   =& $manager->getBlog($blogid);\r
1072                 $currenttime    =  $blog->getCorrectTime(time());\r
1073                 \r
1074                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1075                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1076                 $result = DB::getResult($query);\r
1077                 \r
1078                 if ( $result->rowCount() > 0 )\r
1079                 {\r
1080                                 $blog->setFuturePost();\r
1081                 }\r
1082                 else\r
1083                 {\r
1084                                 $blog->clearFuturePost();\r
1085                 }\r
1086                 return;\r
1087         }\r
1088 \r
1089         /**\r
1090          * Admin::action_itemmove()\r
1091          * \r
1092          * @param       void\r
1093          * @return      void\r
1094          */\r
1095         static private function action_itemmove()\r
1096         {\r
1097                 global $member, $manager;\r
1098                 \r
1099                 $itemid = intRequestVar('itemid');\r
1100                 \r
1101                 $member->canAlterItem($itemid) or self::disallow();\r
1102                 \r
1103                 self::$skin->parse('itemmove');\r
1104                 return;\r
1105         }\r
1106         \r
1107         /**\r
1108          * Admin::action_itemmoveto()\r
1109          * \r
1110          * @param       void\r
1111          * @return      void\r
1112          */\r
1113         static private function action_itemmoveto()\r
1114         {\r
1115                 global $member, $manager;\r
1116                 \r
1117                 $itemid = intRequestVar('itemid');\r
1118                 $catid = requestVar('catid');\r
1119                 \r
1120                 // create new category if needed\r
1121                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1122                 {\r
1123                         // get blogid\r
1124                         list($blogid) = sscanf($catid,'newcat-%d');\r
1125                         \r
1126                         // create\r
1127                         $blog =& $manager->getBlog($blogid);\r
1128                         $catid = $blog->createNewCategory();\r
1129                         \r
1130                         // show error when sth goes wrong\r
1131                         if ( !$catid )\r
1132                         {\r
1133                                 self::doError(_ERROR_CATCREATEFAIL);\r
1134                         }\r
1135                 }\r
1136                 \r
1137                 // only allow if user is allowed to alter item\r
1138                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1139                 \r
1140                 $old_blogid = getBlogIDFromItemId($itemid);\r
1141                 \r
1142                 Item::move($itemid, $catid);\r
1143                 \r
1144                 // set the futurePosted flag on the blog\r
1145                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1146                 \r
1147                 // reset the futurePosted in case the item is moved from one blog to another\r
1148                 self::updateFuturePosted($old_blogid);\r
1149                 \r
1150                 if ( $catid != intRequestVar('catid') )\r
1151                 {\r
1152                         self::action_categoryedit($catid, $blog->getID());\r
1153                 }\r
1154                 else\r
1155                 {\r
1156                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1157                 }\r
1158                 return;\r
1159         }\r
1160         \r
1161         /**\r
1162          * Admin::moveOneItem()\r
1163          * Moves one item to a given category (category existance should be checked by caller)\r
1164          * errors are returned\r
1165          * \r
1166          * @param       integer $itemid         ID for item\r
1167          * @param       integer $destCatid      ID for category to which the item will be moved\r
1168          * @return      void\r
1169          */\r
1170         static public function moveOneItem($itemid, $destCatid)\r
1171         {\r
1172                 global $member;\r
1173                 \r
1174                 // only allow if user is allowed to move item\r
1175                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1176                 {\r
1177                         return _ERROR_DISALLOWED;\r
1178                 }\r
1179                 \r
1180                 Item::move($itemid, $destCatid);\r
1181                 return;\r
1182         }\r
1183         \r
1184         /**\r
1185          * Admin::action_additem()\r
1186          * Adds a item to the chosen blog\r
1187          * \r
1188          * @param       void\r
1189          * @return      void\r
1190          */\r
1191         static private function action_additem()\r
1192         {\r
1193                 global $manager, $CONF;\r
1194                 \r
1195                 $manager->loadClass('ITEM');\r
1196                 \r
1197                 $result = Item::createFromRequest();\r
1198                 \r
1199                 if ( $result['status'] == 'error' )\r
1200                 {\r
1201                         self::error($result['message']);\r
1202                 }\r
1203                 \r
1204                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1205                 \r
1206                 if ( $result['status'] == 'newcategory' )\r
1207                 {\r
1208                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1209                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1210                 }\r
1211                 else\r
1212                 {\r
1213                         $methodName = 'action_itemlist';\r
1214                         self::action_itemlist($item['blogid']);\r
1215                 }\r
1216                 return;\r
1217         }\r
1218         \r
1219         /**\r
1220          * Admin::action_commentedit()\r
1221          * Allows to edit previously made comments\r
1222          * \r
1223          * @param       void\r
1224          * @return      void\r
1225          */\r
1226         static private function action_commentedit()\r
1227         {\r
1228                 global $member, $manager;\r
1229                 \r
1230                 $commentid = intRequestVar('commentid');\r
1231                 \r
1232                 $member->canAlterComment($commentid) or self::disallow();\r
1233                 \r
1234                 $comment = COMMENT::getComment($commentid);\r
1235                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment));\r
1236                 \r
1237                 Admin::$contents = $comment;\r
1238                 self::$skin->parse('commentedit');\r
1239                 return;\r
1240         }\r
1241         \r
1242         /**\r
1243          * Admin::action_commentupdate()\r
1244          * \r
1245          * @param       void\r
1246          * @return      void\r
1247          */\r
1248         static private function action_commentupdate()\r
1249         {\r
1250                 global $member, $manager;\r
1251                 \r
1252                 $commentid = intRequestVar('commentid');\r
1253                 \r
1254                 $member->canAlterComment($commentid) or self::disallow();\r
1255                 \r
1256                 $url    = postVar('url');\r
1257                 $email  = postVar('email');\r
1258                 $body   = postVar('body');\r
1259                 \r
1260                 // intercept words that are too long\r
1261                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1262                 {\r
1263                         self::error(_ERROR_COMMENT_LONGWORD);\r
1264                 }\r
1265                 \r
1266                 // check length\r
1267                 if ( i18n::strlen($body) < 3 )\r
1268                 {\r
1269                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1270                 }\r
1271                 \r
1272                 if ( i18n::strlen($body) > 5000 )\r
1273                 {\r
1274                         self::error(_ERROR_COMMENT_TOOLONG);\r
1275                 }\r
1276                 \r
1277                 // prepare body\r
1278                 $body = Comment::prepareBody($body);\r
1279                 \r
1280                 // call plugins\r
1281                 $data = array(\r
1282                         'body' => &$body\r
1283                 );\r
1284                 $manager->notify('PreUpdateComment', $data);\r
1285                 \r
1286                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1287                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1288                 DB::execute($query);\r
1289                 \r
1290                 // get itemid\r
1291                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1292                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1293                 \r
1294                 $itemid = DB::getValue($query);\r
1295                 \r
1296                 if ( $member->canAlterItem($itemid) )\r
1297                 {\r
1298                         self::action_itemcommentlist($itemid);\r
1299                 }\r
1300                 else\r
1301                 {\r
1302                         self::action_browseowncomments();\r
1303                 }\r
1304                 return;\r
1305         }\r
1306         \r
1307         /**\r
1308          * Admin::action_commentdelete()\r
1309          * Update comment\r
1310          * \r
1311          * @param       void\r
1312          * @return      void\r
1313          */\r
1314         static private function action_commentdelete()\r
1315         {\r
1316                 global $member, $manager;\r
1317                 \r
1318                 $commentid = intRequestVar('commentid');\r
1319                 $member->canAlterComment($commentid) or self::disallow();\r
1320                 \r
1321                 self::$skin->parse('commentdelete');\r
1322                 return;\r
1323         }\r
1324         \r
1325         /**\r
1326          * Admin::action_commentdeleteconfirm()\r
1327          * \r
1328          * @param       void\r
1329          * @return      void\r
1330          */\r
1331         static private function action_commentdeleteconfirm()\r
1332         {\r
1333                 global $member;\r
1334                 \r
1335                 $commentid = intRequestVar('commentid');\r
1336                 \r
1337                 // get item id first\r
1338                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1339                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1340                 \r
1341                 $itemid = DB::getValue($query);\r
1342                 \r
1343                 $error = self::deleteOneComment($commentid);\r
1344                 if ( $error )\r
1345                 {\r
1346                         self::doError($error);\r
1347                 }\r
1348                 \r
1349                 if ( $member->canAlterItem($itemid) )\r
1350                 {\r
1351                         self::action_itemcommentlist($itemid);\r
1352                 }\r
1353                 else\r
1354                 {\r
1355                         self::action_browseowncomments();\r
1356                 }\r
1357                 return;\r
1358         }\r
1359         \r
1360         /**\r
1361          * Admin::deleteOneComment()\r
1362          * \r
1363          * @param       integer $commentid      ID for comment\r
1364          * @return      void\r
1365          */\r
1366         static public function deleteOneComment($commentid)\r
1367         {\r
1368                 global $member, $manager;\r
1369                 \r
1370                 $commentid = (integer) $commentid;\r
1371                 \r
1372                 if ( !$member->canAlterComment($commentid) )\r
1373                 {\r
1374                         return _ERROR_DISALLOWED;\r
1375                 }\r
1376                 \r
1377                 $data = array(\r
1378                         'commentid' => $commentid\r
1379                 );\r
1380                 \r
1381                 $manager->notify('PreDeleteComment', $data);\r
1382                 \r
1383                 // delete the comments associated with the item\r
1384                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1385                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1386                 DB::execute($query);\r
1387                 \r
1388                 $data = array(\r
1389                         'commentid' => $commentid\r
1390                 );\r
1391                 \r
1392                 $manager->notify('PostDeleteComment', $data);\r
1393                 \r
1394                 return '';\r
1395         }\r
1396         \r
1397         /**\r
1398          * Admin::action_usermanagement()\r
1399          * Usermanagement main\r
1400          * \r
1401          * @param       void\r
1402          * @return      void\r
1403          */\r
1404         static private function action_usermanagement()\r
1405         {\r
1406                 global $member, $manager;\r
1407                 \r
1408                 // check if allowed\r
1409                 $member->isAdmin() or self::disallow();\r
1410                 \r
1411                 self::$skin->parse('usermanagement');\r
1412                 return;\r
1413         }\r
1414         \r
1415         /**\r
1416          * Admin::action_memberedit()\r
1417          * Edit member settings\r
1418          * \r
1419          * @param       void\r
1420          * @return      void\r
1421          */\r
1422         static private function action_memberedit()\r
1423         {\r
1424                 self::action_editmembersettings(intRequestVar('memberid'));\r
1425                 return;\r
1426         }\r
1427         \r
1428         /**\r
1429          * Admin::action_editmembersettings()\r
1430          * \r
1431          * @param       integer $memberid       ID for member\r
1432          * @return      void\r
1433          * \r
1434          */\r
1435         static private function action_editmembersettings($memberid = '')\r
1436         {\r
1437                 global $member, $manager, $CONF;\r
1438                 \r
1439                 if ( $memberid == '' )\r
1440                 {\r
1441                         $memberid = $member->getID();\r
1442                 }\r
1443                 \r
1444                 /* TODO: we should consider to use the other way insterad of this */\r
1445                 $_REQUEST['memberid'] = $memberid;\r
1446                 \r
1447                 // check if allowed\r
1448                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1449                 \r
1450                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
1451                 \r
1452                 self::$skin->parse('editmembersettings');\r
1453                 return;\r
1454         }\r
1455         \r
1456         /**\r
1457          * Admin::action_changemembersettings()\r
1458          * \r
1459          * @param       void\r
1460          * @return      void\r
1461          */\r
1462         static private function action_changemembersettings()\r
1463         {\r
1464                 global $member, $CONF, $manager;\r
1465                 \r
1466                 $memberid = intRequestVar('memberid');\r
1467                 \r
1468                 // check if allowed\r
1469                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1470                 \r
1471                 $name                   = trim(strip_tags(postVar('name')));\r
1472                 $realname               = trim(strip_tags(postVar('realname')));\r
1473                 $password               = postVar('password');\r
1474                 $repeatpassword = postVar('repeatpassword');\r
1475                 $email                  = strip_tags(postVar('email'));\r
1476                 $url                    = strip_tags(postVar('url'));\r
1477                 $adminskin              = intPostVar('adminskin');\r
1478                 $bookmarklet    = intPostVar('bookmarklet');\r
1479                 \r
1480                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1481                 if ( !preg_match('#^https?://#', $url) )\r
1482                 {\r
1483                         $url = 'http://' . $url;\r
1484                 }\r
1485                 \r
1486                 $admin          = postVar('admin');\r
1487                 $canlogin       = postVar('canlogin');\r
1488                 $notes          = strip_tags(postVar('notes'));\r
1489                 $locale         = postVar('locale');\r
1490                 \r
1491                 $mem =& $manager->getMember($memberid);\r
1492                 \r
1493                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1494                 {\r
1495                         if ( !isValidDisplayName($name) )\r
1496                         {\r
1497                                 self::error(_ERROR_BADNAME);\r
1498                         }\r
1499                         \r
1500                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1501                         {\r
1502                                 self::error(_ERROR_NICKNAMEINUSE);\r
1503                         }\r
1504                         \r
1505                         if ( $password != $repeatpassword )\r
1506                         {\r
1507                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1508                         }\r
1509                         \r
1510                         if ( $password && (i18n::strlen($password) < 6) )\r
1511                         {\r
1512                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1513                         }\r
1514                                 \r
1515                         if ( $password )\r
1516                         {\r
1517                                 $pwdvalid = true;\r
1518                                 $pwderror = '';\r
1519                                 \r
1520                                 $data = array(\r
1521                                         'password'     => $password,\r
1522                                         'errormessage' => &$pwderror,\r
1523                                         'valid'        => &$pwdvalid\r
1524                                 );\r
1525                                 $manager->notify('PrePasswordSet', $data);\r
1526                                 \r
1527                                 if ( !$pwdvalid )\r
1528                                 {\r
1529                                         self::error($pwderror);\r
1530                                 }\r
1531                         }\r
1532                 }\r
1533                 \r
1534                 if ( !NOTIFICATION::address_validation($email) )\r
1535                 {\r
1536                         self::error(_ERROR_BADMAILADDRESS);\r
1537                 }\r
1538                 if ( !$realname )\r
1539                 {\r
1540                         self::error(_ERROR_REALNAMEMISSING);\r
1541                 }\r
1542                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1543                 {\r
1544                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1545                 }\r
1546                 \r
1547                 // check if there will remain at least one site member with both the logon and admin rights\r
1548                 // (check occurs when taking away one of these rights from such a member)\r
1549                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1550                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1551                         )\r
1552                 {\r
1553                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1554                         if ( $r->rowCount() < 2 )\r
1555                         {\r
1556                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1557                         }\r
1558                 }\r
1559                 \r
1560                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1561                 {\r
1562                         $mem->setDisplayName($name);\r
1563                         if ( $password )\r
1564                         {\r
1565                                 $mem->setPassword($password);\r
1566                         }\r
1567                 }\r
1568                 \r
1569                 $oldEmail = $mem->getEmail();\r
1570                 \r
1571                 $mem->setRealName($realname);\r
1572                 $mem->setEmail($email);\r
1573                 $mem->setURL($url);\r
1574                 $mem->setNotes($notes);\r
1575                 $mem->setLocale($locale);\r
1576                 $mem->setAdminSkin($adminskin);\r
1577                 $mem->setBookmarklet($bookmarklet);\r
1578 \r
1579                 // only allow super-admins to make changes to the admin status\r
1580                 if ( $member->isAdmin() )\r
1581                 {\r
1582                         $mem->setAdmin($admin);\r
1583                         $mem->setCanLogin($canlogin);\r
1584                 }\r
1585                 \r
1586                 $autosave = postVar('autosave');\r
1587                 $mem->setAutosave($autosave);\r
1588                 \r
1589                 $mem->write();\r
1590                 \r
1591                 // store plugin options\r
1592                 $aOptions = requestArray('plugoption');\r
1593                 NucleusPlugin::apply_plugin_options($aOptions);\r
1594                 $data = array(\r
1595                         'context'  => 'member',\r
1596                         'memberid' => $memberid,\r
1597                         'member'   => &$mem\r
1598                 );\r
1599                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1600                 \r
1601                 // if email changed, generate new password\r
1602                 if ( $oldEmail != $mem->getEmail() )\r
1603                 {\r
1604                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1605                         // logout member\r
1606                         $mem->newCookieKey();\r
1607                         \r
1608                         // only log out if the member being edited is the current member.\r
1609                         if ( $member->getID() == $memberid )\r
1610                         {\r
1611                                 $member->logout();\r
1612                         }\r
1613                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1614                         return;\r
1615                 }\r
1616                 \r
1617                 if ( ($mem->getID() == $member->getID())\r
1618                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1619                 {\r
1620                         $mem->newCookieKey();\r
1621                         $member->logout();\r
1622                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1623                 }\r
1624                 else\r
1625                 {\r
1626                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1627                 }\r
1628                 return;\r
1629         }\r
1630 \r
1631         /**\r
1632          * Admin::action_memberadd()\r
1633          * \r
1634          * @param       void\r
1635          * @return      void\r
1636          * \r
1637          */\r
1638         static private function action_memberadd()\r
1639         {\r
1640                 global $member, $manager;\r
1641                 \r
1642                 // check if allowed\r
1643                 $member->isAdmin() or self::disallow();\r
1644                 \r
1645                 if ( postVar('password') != postVar('repeatpassword') )\r
1646                 {\r
1647                         self::error(_ERROR_PASSWORDMISMATCH);\r
1648                 }\r
1649                 \r
1650                 if ( i18n::strlen(postVar('password')) < 6 )\r
1651                 {\r
1652                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1653                 }\r
1654                 \r
1655                 $res = Member::create(\r
1656                         postVar('name'),\r
1657                         postVar('realname'),\r
1658                         postVar('password'),\r
1659                         postVar('email'),\r
1660                         postVar('url'),\r
1661                         postVar('admin'),\r
1662                         postVar('canlogin'),\r
1663                         postVar('notes')\r
1664                 );\r
1665                 \r
1666                 if ( $res != 1 )\r
1667                 {\r
1668                         self::error($res);\r
1669                 }\r
1670                 \r
1671                 // fire PostRegister event\r
1672                 $newmem = new Member();\r
1673                 $newmem->readFromName(postVar('name'));\r
1674                 $data = array(\r
1675                         'member' => &$newmem\r
1676                 );\r
1677                 $manager->notify('PostRegister', $data);\r
1678                 \r
1679                 self::action_usermanagement();\r
1680                 return;\r
1681         }\r
1682         \r
1683         /**\r
1684          * Admin::action_forgotpassword()\r
1685          * \r
1686          * @param       void\r
1687          * @return      void\r
1688          */\r
1689         static private function action_forgotpassword()\r
1690         {\r
1691                 self::$skin->parse('forgotpassword');\r
1692                 return;\r
1693         }\r
1694         \r
1695         /**\r
1696          * Admin::action_activate()\r
1697          * Account activation\r
1698          * \r
1699          * @param       void\r
1700          * @return      void\r
1701          */\r
1702         static private function action_activate()\r
1703         {\r
1704                 $key = getVar('key');\r
1705                 self::showActivationPage($key);\r
1706                 return;\r
1707         }\r
1708         \r
1709         /**\r
1710          * Admin::showActivationPage()\r
1711          * \r
1712          * @param       void\r
1713          * @return      void\r
1714          */\r
1715         static private function showActivationPage($key, $message = '')\r
1716         {\r
1717                 global $manager;\r
1718                 \r
1719                 // clean up old activation keys\r
1720                 Member::cleanupActivationTable();\r
1721                 \r
1722                 // get activation info\r
1723                 $info = Member::getActivationInfo($key);\r
1724                 \r
1725                 if ( !$info )\r
1726                 {\r
1727                         self::error(_ERROR_ACTIVATE);\r
1728                 }\r
1729                 \r
1730                 $mem =& $manager->getMember($info->vmember);\r
1731                 \r
1732                 if ( !$mem )\r
1733                 {\r
1734                         self::error(_ERROR_ACTIVATE);\r
1735                 }\r
1736                 \r
1737                 /* TODO: we should consider to use the other way insterad of this */\r
1738                 $_POST['ackey']                                 = $key;\r
1739                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1740                 \r
1741                 self::$headMess = $message;\r
1742                 self::$skin->parse('activate');\r
1743                 return;\r
1744         }\r
1745         \r
1746         /**\r
1747          * Admin::action_activatesetpwd()\r
1748          * Account activation - set password part\r
1749          * \r
1750          * @param       void\r
1751          * @return      void\r
1752          */\r
1753         static private function action_activatesetpwd()\r
1754         {\r
1755                 global $manager;\r
1756                 $key = postVar('key');\r
1757                 \r
1758                 // clean up old activation keys\r
1759                 Member::cleanupActivationTable();\r
1760                 \r
1761                 // get activation info\r
1762                 $info = Member::getActivationInfo($key);\r
1763                 \r
1764                 if ( !$info || ($info->type == 'addresschange') )\r
1765                 {\r
1766                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1767                 }\r
1768                 \r
1769                 $mem =& $manager->getMember($info->vmember);\r
1770                 \r
1771                 if ( !$mem )\r
1772                 {\r
1773                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1774                 }\r
1775                 \r
1776                 $password               = postVar('password');\r
1777                 $repeatpassword = postVar('repeatpassword');\r
1778                 \r
1779                 if ( $password != $repeatpassword )\r
1780                 {\r
1781                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1782                 }\r
1783                 \r
1784                 if ( $password && (i18n::strlen($password) < 6) )\r
1785                 {\r
1786                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1787                 }\r
1788                         \r
1789                 if ( $password )\r
1790                 {\r
1791                         $pwdvalid = true;\r
1792                         $pwderror = '';\r
1793                         \r
1794                         $data = array(\r
1795                                 'password'              => $password,\r
1796                                 'errormessage'  => &$pwderror,\r
1797                                 'valid'                 => &$pwdvalid\r
1798                         );\r
1799                         $manager->notify('PrePasswordSet', $data);\r
1800                         if ( !$pwdvalid )\r
1801                         {\r
1802                                 return self::showActivationPage($key,$pwderror);\r
1803                         }\r
1804                 }\r
1805                 \r
1806                 $error = '';\r
1807                 \r
1808                 $data = array(\r
1809                         'type'   => 'activation',\r
1810                         'member' => $mem,\r
1811                         'error'  => &$error\r
1812                 );\r
1813                 $manager->notify('ValidateForm', $data);\r
1814                 if ( $error != '' )\r
1815                 {\r
1816                         return self::showActivationPage($key, $error);\r
1817                 }\r
1818                 \r
1819                 // set password\r
1820                 $mem->setPassword($password);\r
1821                 $mem->write();\r
1822                 \r
1823                 // do the activation\r
1824                 Member::activate($key);\r
1825                 \r
1826                 self::$skin->parse('activatesetpwd');\r
1827                 return;\r
1828         }\r
1829         \r
1830         /**\r
1831          * Admin::action_manageteam()\r
1832          * Manage team\r
1833          * \r
1834          * @param       void\r
1835          * @return      void\r
1836          */\r
1837         static private function action_manageteam()\r
1838         {\r
1839                 global $member, $manager;\r
1840                 \r
1841                 $blogid = intRequestVar('blogid');\r
1842                 \r
1843                 // check if allowed\r
1844                 $member->blogAdminRights($blogid) or self::disallow();\r
1845                 \r
1846                 self::$skin->parse('manageteam');\r
1847                 return;\r
1848         }\r
1849         \r
1850         /**\r
1851          * Admin::action_teamaddmember()\r
1852          * Add member to team\r
1853          * \r
1854          * @param       void\r
1855          * @return      void\r
1856          */\r
1857         static private function action_teamaddmember()\r
1858         {\r
1859                 global $member, $manager;\r
1860                 \r
1861                 $memberid       = intPostVar('memberid');\r
1862                 $blogid         = intPostVar('blogid');\r
1863                 $admin          = intPostVar('admin');\r
1864                 \r
1865                 // check if allowed\r
1866                 $member->blogAdminRights($blogid) or self::disallow();\r
1867                 \r
1868                 $blog =& $manager->getBlog($blogid);\r
1869                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1870                 {\r
1871                         self::error(_ERROR_ALREADYONTEAM);\r
1872                 }\r
1873                 \r
1874                 self::action_manageteam();\r
1875                 return;\r
1876         }\r
1877         \r
1878         /**\r
1879          * Admin::action_teamdelete()\r
1880          * \r
1881          * @param       void\r
1882          * @return      void\r
1883          */\r
1884         static private function action_teamdelete()\r
1885         {\r
1886                 global $member, $manager;\r
1887                 \r
1888                 $memberid       = intRequestVar('memberid');\r
1889                 $blogid         = intRequestVar('blogid');\r
1890                 \r
1891                 // check if allowed\r
1892                 $member->blogAdminRights($blogid) or self::disallow();\r
1893                 \r
1894                 $teammem =& $manager->getMember($memberid);\r
1895                 $blog =& $manager->getBlog($blogid);\r
1896                 \r
1897                 self::$skin->parse('teamdelete');\r
1898                 return;\r
1899         }\r
1900         \r
1901         /**\r
1902          * Admin::action_teamdeleteconfirm()\r
1903          * \r
1904          * @param       void\r
1905          * @return      void\r
1906          */\r
1907         static private function action_teamdeleteconfirm()\r
1908         {\r
1909                 global $member;\r
1910                 \r
1911                 $memberid = intRequestVar('memberid');\r
1912                 $blogid = intRequestVar('blogid');\r
1913                 \r
1914                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1915                 if ( $error )\r
1916                 {\r
1917                         self::error($error);\r
1918                 }\r
1919                 self::action_manageteam();\r
1920                 return;\r
1921         }\r
1922         \r
1923         /**\r
1924          * Admin::deleteOneTeamMember()\r
1925          * \r
1926          * @param       void\r
1927          * @return      void\r
1928          */\r
1929         static public function deleteOneTeamMember($blogid, $memberid)\r
1930         {\r
1931                 global $member, $manager;\r
1932                 \r
1933                 $blogid   = intval($blogid);\r
1934                 $memberid = intval($memberid);\r
1935                 \r
1936                 // check if allowed\r
1937                 if ( !$member->blogAdminRights($blogid) )\r
1938                 {\r
1939                         return _ERROR_DISALLOWED;\r
1940                 }\r
1941                 \r
1942                 // check if: - there remains at least one blog admin\r
1943                 //           - (there remains at least one team member)\r
1944                 $tmem =& $manager->getMember($memberid);\r
1945                 \r
1946                 \r
1947                 $data = array(\r
1948                         'member' => &$tmem,\r
1949                         'blogid' => $blogid\r
1950                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1951                 \r
1952                 if ( $tmem->isBlogAdmin($blogid) )\r
1953                 {\r
1954                         /* TODO: why we did double check? */\r
1955                         // check if there are more blog members left and at least one admin\r
1956                         // (check for at least two admins before deletion)\r
1957                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1958                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1959                         $r     = DB::getResult($query);\r
1960                         if ( $r->rowCount() < 2 )\r
1961                         {\r
1962                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1963                         }\r
1964                 }\r
1965                 \r
1966                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1967                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1968                 DB::execute($query);\r
1969                 \r
1970                 $data = array(\r
1971                         'member' => &$tmem,\r
1972                         'blogid' => $blogid\r
1973                 );\r
1974                 $manager->notify('PostDeleteTeamMember', $data);\r
1975                 \r
1976                 return '';\r
1977         }\r
1978         \r
1979         /**\r
1980          * Admin::action_teamchangeadmin()\r
1981          * \r
1982          * @param       void\r
1983          * @return      void\r
1984          */\r
1985         static private function action_teamchangeadmin()\r
1986         {\r
1987                 global $manager, $member;\r
1988                 \r
1989                 $blogid         = intRequestVar('blogid');\r
1990                 $memberid       = intRequestVar('memberid');\r
1991                 \r
1992                 // check if allowed\r
1993                 $member->blogAdminRights($blogid) or self::disallow();\r
1994                 \r
1995                 $mem =& $manager->getMember($memberid);\r
1996                 \r
1997                 // don't allow when there is only one admin at this moment\r
1998                 if ( $mem->isBlogAdmin($blogid) )\r
1999                 {\r
2000                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2001                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2002                         $r = DB::getResult($query);\r
2003                         if ( $r->rowCount() == 1 )\r
2004                         {\r
2005                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2006                         }\r
2007                 }\r
2008                 \r
2009                 if ( $mem->isBlogAdmin($blogid) )\r
2010                 {\r
2011                         $newval = 0;\r
2012                 }\r
2013                 else\r
2014                 {\r
2015                         $newval = 1;\r
2016                 }\r
2017                 \r
2018                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2019                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2020                 DB::execute($query);\r
2021                 \r
2022                 // only show manageteam if member did not change its own admin privileges\r
2023                 if ( $member->isBlogAdmin($blogid) )\r
2024                 {\r
2025                         self::action_manageteam();\r
2026                 }\r
2027                 else\r
2028                 {\r
2029                         self::action_overview(_MSG_ADMINCHANGED);\r
2030                 }\r
2031                 return;\r
2032         }\r
2033         \r
2034         /**\r
2035          * Admin::action_blogsettings()\r
2036          * \r
2037          * @param       void\r
2038          * @return      void\r
2039          */\r
2040         static private function action_blogsettings()\r
2041         {\r
2042                 global $member, $manager;\r
2043                 \r
2044                 $blogid = intRequestVar('blogid');\r
2045                 \r
2046                 // check if allowed\r
2047                 $member->blogAdminRights($blogid) or self::disallow();\r
2048                 \r
2049                 $blog =& $manager->getBlog($blogid);\r
2050                 \r
2051                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2052                 \r
2053                 self::$skin->parse('blogsettings');\r
2054                 return;\r
2055         }\r
2056         \r
2057         /**\r
2058          * Admin::action_categorynew()\r
2059          * \r
2060          * @param       void\r
2061          * @return      void\r
2062          */\r
2063         static private function action_categorynew()\r
2064         {\r
2065                 global $member, $manager;\r
2066                 \r
2067                 $blogid = intRequestVar('blogid');\r
2068                 \r
2069                 $member->blogAdminRights($blogid) or self::disallow();\r
2070                 \r
2071                 $cname = postVar('cname');\r
2072                 $cdesc = postVar('cdesc');\r
2073                 \r
2074                 if ( !isValidCategoryName($cname) )\r
2075                 {\r
2076                         self::error(_ERROR_BADCATEGORYNAME);\r
2077                 }\r
2078                 \r
2079                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2080                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2081                 $res = DB::getResult($query);\r
2082                 if ( $res->rowCount() > 0 )\r
2083                 {\r
2084                         self::error(_ERROR_DUPCATEGORYNAME);\r
2085                 }\r
2086                 \r
2087                 $blog           =& $manager->getBlog($blogid);\r
2088                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2089                 \r
2090                 self::action_blogsettings();\r
2091                 return;\r
2092         }\r
2093         \r
2094         /**\r
2095          * Admin::action_categoryedit()\r
2096          * \r
2097          * @param       void\r
2098          * @return      void\r
2099          */\r
2100         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2101         {\r
2102                 global $member, $manager;\r
2103                 \r
2104                 if ( $blogid == '' )\r
2105                 {\r
2106                         $blogid = intGetVar('blogid');\r
2107                 }\r
2108                 else\r
2109                 {\r
2110                         $blogid = intval($blogid);\r
2111                 }\r
2112                 if ( $catid == '' )\r
2113                 {\r
2114                         $catid = intGetVar('catid');\r
2115                 }\r
2116                 else\r
2117                 {\r
2118                         $catid = intval($catid);\r
2119                 }\r
2120                 \r
2121                 /* TODO: we should consider to use the other way insterad of this */\r
2122                 $_REQUEST['blogid']             = $blogid;\r
2123                 $_REQUEST['catid']              = $catid;\r
2124                 $_REQUEST['desturl']    = $desturl;\r
2125                 $member->blogAdminRights($blogid) or self::disallow();\r
2126                 \r
2127                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
2128                 \r
2129                 self::$skin->parse('categoryedit');\r
2130                 return;\r
2131         }\r
2132         \r
2133         /**\r
2134          * Admin::action_categoryupdate()\r
2135          * \r
2136          * @param       void\r
2137          * @return      void\r
2138          */\r
2139         static private function action_categoryupdate()\r
2140         {\r
2141                 global $member, $manager;\r
2142                 \r
2143                 $blogid         = intPostVar('blogid');\r
2144                 $catid          = intPostVar('catid');\r
2145                 $cname          = postVar('cname');\r
2146                 $cdesc          = postVar('cdesc');\r
2147                 $desturl        = postVar('desturl');\r
2148                 \r
2149                 $member->blogAdminRights($blogid) or self::disallow();\r
2150                 \r
2151                 if ( !isValidCategoryName($cname) )\r
2152                 {\r
2153                         self::error(_ERROR_BADCATEGORYNAME);\r
2154                 }\r
2155                 \r
2156                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2157                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2158                 $res    = DB::getResult($query);\r
2159                 if ( $res->rowCount() > 0 )\r
2160                 {\r
2161                         self::error(_ERROR_DUPCATEGORYNAME);\r
2162                 }\r
2163                 \r
2164                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2165                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2166                 DB::execute($query);\r
2167                 \r
2168                 // store plugin options\r
2169                 $aOptions = requestArray('plugoption');\r
2170                 NucleusPlugin::apply_plugin_options($aOptions);\r
2171                 $data = array(\r
2172                         'context'       => 'category',\r
2173                         'catid'         => $catid\r
2174                 );\r
2175                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2176                 \r
2177                 if ( $desturl )\r
2178                 {\r
2179                         redirect($desturl);\r
2180                         exit;\r
2181                 }\r
2182                 else\r
2183                 {\r
2184                         self::action_blogsettings();\r
2185                 }\r
2186                 return;\r
2187         }\r
2188         \r
2189         /**\r
2190          * Admin::action_categorydelete()\r
2191          * \r
2192          * @param       void\r
2193          * @return      void\r
2194          */\r
2195         static private function action_categorydelete()\r
2196         {\r
2197                 global $member, $manager;\r
2198                 \r
2199                 $blogid = intRequestVar('blogid');\r
2200                 $catid  = intRequestVar('catid');\r
2201                 \r
2202                 $member->blogAdminRights($blogid) or self::disallow();\r
2203                 \r
2204                 $blog =& $manager->getBlog($blogid);\r
2205                 \r
2206                 // check if the category is valid\r
2207                 if ( !$blog->isValidCategory($catid) )\r
2208                 {\r
2209                         self::error(_ERROR_NOSUCHCATEGORY);\r
2210                 }\r
2211                 \r
2212                 // don't allow deletion of default category\r
2213                 if ( $blog->getDefaultCategory() == $catid )\r
2214                 {\r
2215                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2216                 }\r
2217                 \r
2218                 // check if catid is the only category left for blogid\r
2219                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2220                 $query = sprintf($query, sql_table('category'), $blogid);\r
2221                 $res = DB::getResult($query);\r
2222                 if ( $res->rowCount() == 1 )\r
2223                 {\r
2224                         self::error(_ERROR_DELETELASTCATEGORY);\r
2225                 }\r
2226                 \r
2227                 self::$skin->parse('categorydelete');\r
2228                 return;\r
2229         }\r
2230         \r
2231         /**\r
2232          * Admin::action_categorydeleteconfirm()\r
2233          * \r
2234          * @param       void\r
2235          * @return      void\r
2236          */\r
2237         static private function action_categorydeleteconfirm()\r
2238         {\r
2239                 global $member, $manager;\r
2240                 \r
2241                 $blogid = intRequestVar('blogid');\r
2242                 $catid  = intRequestVar('catid');\r
2243                 \r
2244                 $member->blogAdminRights($blogid) or self::disallow();\r
2245                 \r
2246                 $error = self::deleteOneCategory($catid);\r
2247                 if ( $error )\r
2248                 {\r
2249                         self::error($error);\r
2250                 }\r
2251                 \r
2252                 self::action_blogsettings();\r
2253                 return;\r
2254         }\r
2255         \r
2256         /**\r
2257          * Admin::deleteOneCategory()\r
2258          * Delete a category by its id\r
2259          * \r
2260          * @param       String  $catid  category id for deleting\r
2261          * @return      Void\r
2262          */\r
2263         static public function deleteOneCategory($catid)\r
2264         {\r
2265                 global $manager, $member;\r
2266                 \r
2267                 $catid  = intval($catid);\r
2268                 $blogid = getBlogIDFromCatID($catid);\r
2269                 \r
2270                 if ( !$member->blogAdminRights($blogid) )\r
2271                 {\r
2272                         return ERROR_DISALLOWED;\r
2273                 }\r
2274                 \r
2275                 // get blog\r
2276                 $blog =& $manager->getBlog($blogid);\r
2277                 \r
2278                 // check if the category is valid\r
2279                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2280                 {\r
2281                         return _ERROR_NOSUCHCATEGORY;\r
2282                 }\r
2283                 \r
2284                 $destcatid = $blog->getDefaultCategory();\r
2285                 \r
2286                 // don't allow deletion of default category\r
2287                 if ( $blog->getDefaultCategory() == $catid )\r
2288                 {\r
2289                         return _ERROR_DELETEDEFCATEGORY;\r
2290                 }\r
2291                 \r
2292                 // check if catid is the only category left for blogid\r
2293                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2294                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2295                 \r
2296                 $res = DB::getResult($query);\r
2297                 if ( $res->rowCount() == 1 )\r
2298                 {\r
2299                         return _ERROR_DELETELASTCATEGORY;\r
2300                 }\r
2301                 \r
2302                 $data = array('catid' => $catid);\r
2303                 $manager->notify('PreDeleteCategory', $data);\r
2304                 \r
2305                 // change category for all items to the default category\r
2306                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2307                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2308                 DB::execute($query);\r
2309                 \r
2310                 // delete all associated plugin options\r
2311                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2312                 \r
2313                 // delete category\r
2314                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2315                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2316                 DB::execute($query);\r
2317                 \r
2318                 $data = array('catid' => $catid);\r
2319                 $manager->notify('PostDeleteCategory', $data);\r
2320                 return;\r
2321         }\r
2322         \r
2323         /**\r
2324          * Admin::moveOneCategory()\r
2325          * Delete a category by its id\r
2326          * \r
2327          * @param       int     $catid          category id for move\r
2328          * @param       int     $destblogid     blog id for destination\r
2329          * @return      void\r
2330          */\r
2331         static public function moveOneCategory($catid, $destblogid)\r
2332         {\r
2333                 global $manager, $member;\r
2334                 $catid      = intval($catid);\r
2335                 $destblogid = intval($destblogid);\r
2336                 $blogid     = getBlogIDFromCatID($catid);\r
2337                 // mover should have admin rights on both blogs\r
2338                 if (!$member->blogAdminRights($blogid)) {\r
2339                         return _ERROR_DISALLOWED;\r
2340                 }\r
2341                 if (!$member->blogAdminRights($destblogid)) {\r
2342                         return _ERROR_DISALLOWED;\r
2343                 }\r
2344                 // cannot move to self\r
2345                 if ($blogid == $destblogid) {\r
2346                         return _ERROR_MOVETOSELF;\r
2347                 }\r
2348                 // get blogs\r
2349                 $blog     =& $manager->getBlog($blogid);\r
2350                 $destblog =& $manager->getBlog($destblogid);\r
2351                 // check if the category is valid\r
2352                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2353                         return _ERROR_NOSUCHCATEGORY;\r
2354                 }\r
2355                 // don't allow default category to be moved\r
2356                 if ($blog->getDefaultCategory() == $catid) {\r
2357                         return _ERROR_MOVEDEFCATEGORY;\r
2358                 }\r
2359                 $manager->notify(\r
2360                                 'PreMoveCategory',\r
2361                                 array(\r
2362                                                 'catid'      => &$catid,\r
2363                                                 'sourceblog' => &$blog,\r
2364                                                 'destblog'   => &$destblog\r
2365                                 )\r
2366                 );\r
2367                 // update comments table (cblog)\r
2368                 $query = 'SELECT '\r
2369                 . '    inumber '\r
2370                 . 'FROM '\r
2371                 .      sql_table('item') . ' '\r
2372                 . 'WHERE '\r
2373                 . '    icat = %d';\r
2374                 $items = sql_query(sprintf($query, $catid));\r
2375                 while ($oItem = sql_fetch_object($items)) {\r
2376                         $query = 'UPDATE '\r
2377                         .      sql_table('comment') . ' '\r
2378                         . 'SET '\r
2379                         . '    cblog = %d' . ' '\r
2380                         . 'WHERE '\r
2381                         . '    citem = %d';\r
2382                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2383                 }\r
2384         \r
2385                 // update items (iblog)\r
2386                 $query = 'UPDATE '\r
2387                 .      sql_table('item') . ' '\r
2388                 . 'SET '\r
2389                 . '    iblog = %d '\r
2390                 . 'WHERE '\r
2391                 . '    icat = %d';\r
2392                 sql_query(sprintf($query, $destblogid, $catid));\r
2393         \r
2394                 // move category\r
2395                 $query = 'UPDATE '\r
2396                 .      sql_table('category') . ' '\r
2397                 . 'SET '\r
2398                 . '    cblog = %d' . ' '\r
2399                 . 'WHERE '\r
2400                 . '    catid = %d';\r
2401                 sql_query(sprintf($query, $destblogid, $catid));\r
2402                 $manager->notify(\r
2403                                 'PostMoveCategory',\r
2404                                 array(\r
2405                                                 'catid'      => &$catid,\r
2406                                                 'sourceblog' => &$blog,\r
2407                                                 'destblog'   => $destblog\r
2408                                 )\r
2409                 );\r
2410                 return;\r
2411         }\r
2412 \r
2413         /**\r
2414          * Admin::action_blogsettingsupdate\r
2415          * Updating blog settings\r
2416          * \r
2417          * @param       Void\r
2418          * @return      Void\r
2419          */\r
2420         static private function action_blogsettingsupdate()\r
2421         {\r
2422                 global $member, $manager;\r
2423                 \r
2424                 $blogid = intRequestVar('blogid');\r
2425                 \r
2426                 $member->blogAdminRights($blogid) or self::disallow();\r
2427                 \r
2428                 $blog =& $manager->getBlog($blogid);\r
2429                 \r
2430                 $notify_address = trim(postVar('notify'));\r
2431                 $shortname              = trim(postVar('shortname'));\r
2432                 $updatefile             = trim(postVar('update'));\r
2433                 \r
2434                 $notifyComment  = intPostVar('notifyComment');\r
2435                 $notifyVote             = intPostVar('notifyVote');\r
2436                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2437                 \r
2438                 if ( $notifyComment == 0 )\r
2439                 {\r
2440                         $notifyComment = 1;\r
2441                 }\r
2442                 if ( $notifyVote == 0 )\r
2443                 {\r
2444                         $notifyVote = 1;\r
2445                 }\r
2446                 if ( $notifyNewItem == 0 )\r
2447                 {\r
2448                         $notifyNewItem = 1;\r
2449                 }\r
2450                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2451                 \r
2452                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2453                 {\r
2454                         self::error(_ERROR_BADNOTIFY);\r
2455                 }\r
2456                 \r
2457                 if ( !isValidShortName($shortname) )\r
2458                 {\r
2459                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2460                 }\r
2461                 \r
2462                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2463                 {\r
2464                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2465                 }\r
2466                 // check if update file is writable\r
2467                 if ( $updatefile && !is_writeable($updatefile) )\r
2468                 {\r
2469                         self::error(_ERROR_UPDATEFILE);\r
2470                 }\r
2471                 \r
2472                 $blog->setName(trim(postVar('name')));\r
2473                 $blog->setShortName($shortname);\r
2474                 $blog->setNotifyAddress($notify_address);\r
2475                 $blog->setNotifyType($notifyType);\r
2476                 $blog->setMaxComments(postVar('maxcomments'));\r
2477                 $blog->setCommentsEnabled(postVar('comments'));\r
2478                 $blog->setTimeOffset(postVar('timeoffset'));\r
2479                 $blog->setUpdateFile($updatefile);\r
2480                 $blog->setURL(trim(postVar('url')));\r
2481                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2482                 $blog->setDescription(trim(postVar('desc')));\r
2483                 $blog->setPublic(postVar('public'));\r
2484                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2485                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2486                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2487                 $blog->setSearchable(intPostVar('searchable'));\r
2488                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2489                 $blog->writeSettings();\r
2490                 \r
2491                 // store plugin options\r
2492                 $aOptions = requestArray('plugoption');\r
2493                 NucleusPlugin::apply_plugin_options($aOptions);\r
2494                 \r
2495                 $data = array(\r
2496                         'context' => 'blog',\r
2497                         'blogid'  => $blogid,\r
2498                         'blog'    => &$blog\r
2499                 );\r
2500                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2501                 \r
2502                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2503                 return;\r
2504         }\r
2505         \r
2506         /**\r
2507          * Admin::action_deleteblog()\r
2508          * \r
2509          * @param       void\r
2510          * @return      void\r
2511          */\r
2512         static private function action_deleteblog()\r
2513         {\r
2514                 global $member, $CONF, $manager;\r
2515                 \r
2516                 $blogid = intRequestVar('blogid');\r
2517                 \r
2518                 $member->blogAdminRights($blogid) or self::disallow();\r
2519                 \r
2520                 // check if blog is default blog\r
2521                 if ( $CONF['DefaultBlog'] == $blogid )\r
2522                 {\r
2523                         self::error(_ERROR_DELDEFBLOG);\r
2524                 }\r
2525                 \r
2526                 $blog =& $manager->getBlog($blogid);\r
2527                 \r
2528                 self::$skin->parse('deleteblog');\r
2529                 return;\r
2530         }\r
2531         \r
2532         /**\r
2533          * Admin::action_deleteblogconfirm()\r
2534          * Delete Blog\r
2535          * \r
2536          * @param       Void\r
2537          * @return      Void\r
2538          */\r
2539         static private function action_deleteblogconfirm()\r
2540         {\r
2541                 global $member, $CONF, $manager;\r
2542                 \r
2543                 $blogid = intRequestVar('blogid');\r
2544                 \r
2545                 $data = array('blogid' => $blogid);\r
2546                 $manager->notify('PreDeleteBlog', $data);\r
2547                 \r
2548                 $member->blogAdminRights($blogid) or self::disallow();\r
2549                 \r
2550                 // check if blog is default blog\r
2551                 if ( $CONF['DefaultBlog'] == $blogid )\r
2552                 {\r
2553                         self::error(_ERROR_DELDEFBLOG);\r
2554                 }\r
2555                 \r
2556                 // delete all comments\r
2557                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2558                 DB::execute($query);\r
2559                 \r
2560                 // delete all items\r
2561                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2562                 DB::execute($query);\r
2563                 \r
2564                 // delete all team members\r
2565                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2566                 DB::execute($query);\r
2567                 \r
2568                 // delete all bans\r
2569                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2570                 DB::execute($query);\r
2571                 \r
2572                 // delete all categories\r
2573                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2574                 DB::execute($query);\r
2575                 \r
2576                 // delete all associated plugin options\r
2577                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2578                 \r
2579                 // delete the blog itself\r
2580                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2581                 DB::execute($query);\r
2582                 \r
2583                 $data = array('blogid' => $blogid);\r
2584                 $manager->notify('PostDeleteBlog', $data);\r
2585                 \r
2586                 self::action_overview(_DELETED_BLOG);\r
2587                 return;\r
2588         }\r
2589         \r
2590         /**\r
2591          * Admin::action_memberdelete()\r
2592          * \r
2593          * @param       void\r
2594          * @return      void\r
2595          */\r
2596         static private function action_memberdelete()\r
2597         {\r
2598                 global $member, $manager;\r
2599                 \r
2600                 $memberid = intRequestVar('memberid');\r
2601                 \r
2602                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2603                 \r
2604                 $mem =& $manager->getMember($memberid);\r
2605                 \r
2606                 self::$skin->parse('memberdelete');\r
2607                 return;\r
2608         }\r
2609         \r
2610         /**\r
2611          * Admin::action_memberdeleteconfirm()\r
2612          * \r
2613          * @param       void\r
2614          * @return      void\r
2615          */\r
2616         static private function action_memberdeleteconfirm()\r
2617         {\r
2618                 global $member;\r
2619                 \r
2620                 $memberid = intRequestVar('memberid');\r
2621                 \r
2622                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2623                 \r
2624                 $error = self::deleteOneMember($memberid);\r
2625                 if ( $error )\r
2626                 {\r
2627                         self::error($error);\r
2628                 }\r
2629                 \r
2630                 if ( $member->isAdmin() )\r
2631                 {\r
2632                         self::action_usermanagement();\r
2633                 }\r
2634                 else\r
2635                 {\r
2636                         self::action_overview(_DELETED_MEMBER);\r
2637                 }\r
2638                 return;\r
2639         }\r
2640         \r
2641         /**\r
2642          * Admin::deleteOneMember()\r
2643          * Delete a member by id\r
2644          * \r
2645          * @static\r
2646          * @params      Integer $memberid       member id\r
2647          * @return      String  null string or error messages\r
2648          */\r
2649         static public function deleteOneMember($memberid)\r
2650         {\r
2651                 global $manager;\r
2652                 \r
2653                 $memberid = intval($memberid);\r
2654                 $mem =& $manager->getMember($memberid);\r
2655                 \r
2656                 if ( !$mem->canBeDeleted() )\r
2657                 {\r
2658                         return _ERROR_DELETEMEMBER;\r
2659                 }\r
2660                 \r
2661                 $data = array('member' => &$mem);\r
2662                 $manager->notify('PreDeleteMember', $data);\r
2663                 \r
2664                 /* unlink comments from memberid */\r
2665                 if ( $memberid )\r
2666                 {\r
2667                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2668                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2669                         DB::execute($query);\r
2670                 }\r
2671                 \r
2672                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2673                 DB::execute($query);\r
2674                 \r
2675                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2676                 DB::execute($query);\r
2677                 \r
2678                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2679                 DB::execute($query);\r
2680                 \r
2681                 // delete all associated plugin options\r
2682                 NucleusPlugin::delete_option_values('member', $memberid);\r
2683                 \r
2684                 $data = array('member' => &$mem);\r
2685                 $manager->notify('PostDeleteMember', $data);\r
2686                 \r
2687                 return '';\r
2688         }\r
2689         \r
2690         /**\r
2691          * Admin::action_createnewlog()\r
2692          * \r
2693          * @param       void\r
2694          * @return      void\r
2695          */\r
2696         static private function action_createnewlog()\r
2697         {\r
2698                 global $member, $CONF, $manager;\r
2699                 \r
2700                 // Only Super-Admins can do this\r
2701                 $member->isAdmin() or self::disallow();\r
2702                 \r
2703                 self::$skin->parse('createnewlog');\r
2704                 return;\r
2705         }\r
2706         \r
2707         /**\r
2708          * Admin::action_addnewlog()\r
2709          * \r
2710          * @param       void\r
2711          * @return      void\r
2712          */\r
2713         static private function action_addnewlog()\r
2714         {\r
2715                 global $member, $manager, $CONF;\r
2716                 \r
2717                 // Only Super-Admins can do this\r
2718                 $member->isAdmin() or self::disallow();\r
2719                 \r
2720                 $bname                  = trim(postVar('name'));\r
2721                 $bshortname             = trim(postVar('shortname'));\r
2722                 $btimeoffset    = postVar('timeoffset');\r
2723                 $bdesc                  = trim(postVar('desc'));\r
2724                 $bdefskin               = postVar('defskin');\r
2725                 \r
2726                 if ( !isValidShortName($bshortname) )\r
2727                 {\r
2728                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2729                 }\r
2730                 \r
2731                 if ( $manager->existsBlog($bshortname) )\r
2732                 {\r
2733                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2734                 }\r
2735                 \r
2736                 $data = array(\r
2737                         'name'        => &$bname,\r
2738                         'shortname'   => &$bshortname,\r
2739                         'timeoffset'  => &$btimeoffset,\r
2740                         'description' => &$bdesc,\r
2741                         'defaultskin' => &$bdefskin\r
2742                 );\r
2743                 $manager->notify('PreAddBlog', $data);\r
2744                 \r
2745                 // add slashes for sql queries\r
2746                 $bname                  = DB::quoteValue($bname);\r
2747                 $bshortname             = DB::quoteValue($bshortname);\r
2748                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2749                 $bdesc                  = DB::quoteValue($bdesc);\r
2750                 $bdefskin               = DB::quoteValue($bdefskin);\r
2751                 \r
2752                 // create blog\r
2753                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2754                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2755                 DB::execute($query);\r
2756                 \r
2757                 $blogid = DB::getInsertId();\r
2758                 $blog   =& $manager->getBlog($blogid);\r
2759                 \r
2760                 // create new category\r
2761                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2762                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2763                 \r
2764                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2765                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2766                 $catid = DB::getInsertId();\r
2767                 \r
2768                 // set as default category\r
2769                 $blog->setDefaultCategory($catid);\r
2770                 $blog->writeSettings();\r
2771                 \r
2772                 // create team member\r
2773                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2774                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2775                 DB::execute($query);\r
2776                 \r
2777                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2778                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2779                 \r
2780                 $blog->additem(\r
2781                         $blog->getDefaultCategory(),\r
2782                         $itemdeftitle,$itemdefbody,\r
2783                         '',\r
2784                         $blogid,\r
2785                         $member->getID(),\r
2786                         $blog->getCorrectTime(),\r
2787                         0,\r
2788                         0,\r
2789                         0\r
2790                 );\r
2791                 \r
2792                 $data = array('blog' => &$blog);\r
2793                 $manager->notify('PostAddBlog', $data);\r
2794                 \r
2795                 $data = array(\r
2796                         'blog'                  => &$blog,\r
2797                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2798                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2799                         'catid'                 => $catid\r
2800                 );\r
2801                 $manager->notify('PostAddCategory', $data);\r
2802                 \r
2803                 /* TODO: we should consider to use the other way insterad of this */\r
2804                 $_REQUEST['blogid'] = $blogid;\r
2805                 $_REQUEST['catid']  = $catid;\r
2806                 self::$skin->parse('addnewlog');\r
2807                 return;\r
2808         }\r
2809         \r
2810         /**\r
2811          * Admin::action_addnewlog2()\r
2812          * \r
2813          * @param       void\r
2814          * @return      void\r
2815          */\r
2816         static private function action_addnewlog2()\r
2817         {\r
2818                 global $member, $manager;\r
2819                 $blogid = intRequestVar('blogid');\r
2820                 \r
2821                 $member->blogAdminRights($blogid) or self::disallow();\r
2822                 \r
2823                 $burl = requestVar('url');\r
2824                 \r
2825                 $blog =& $manager->getBlog($blogid);\r
2826                 $blog->setURL(trim($burl));\r
2827                 $blog->writeSettings();\r
2828                 \r
2829                 self::action_overview(_MSG_NEWBLOG);\r
2830                 return;\r
2831         }\r
2832         \r
2833         /**\r
2834          * Admin::action_skinieoverview()\r
2835          * \r
2836          * @param       void\r
2837          * @return      void\r
2838          */\r
2839         static private function action_skinieoverview()\r
2840         {\r
2841                 global $member, $DIR_LIBS, $manager;\r
2842                 \r
2843                 $member->isAdmin() or self::disallow();\r
2844                 \r
2845                 include_once($DIR_LIBS . 'skinie.php');\r
2846                 \r
2847                 self::$skin->parse('skinieoverview');\r
2848                 return;\r
2849         }\r
2850         \r
2851         /**\r
2852          * Admin::action_skinieimport()\r
2853          * \r
2854          * @param       void\r
2855          * @return      void\r
2856          */\r
2857         static private function action_skinieimport()\r
2858         {\r
2859                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2860                 \r
2861                 $member->isAdmin() or self::disallow();\r
2862                 \r
2863                 // load skinie class\r
2864                 include_once($DIR_LIBS . 'skinie.php');\r
2865                 \r
2866                 $skinFileRaw    = postVar('skinfile');\r
2867                 $mode                   = postVar('mode');\r
2868                 \r
2869                 $importer = new SkinImport();\r
2870                 \r
2871                 // get full filename\r
2872                 if ( $mode == 'file' )\r
2873                 {\r
2874                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2875                         \r
2876                         /* TODO: remove this\r
2877                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2878                         if ( !file_exists($skinFile) )\r
2879                         {\r
2880                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2881                         }\r
2882                          */\r
2883                 }\r
2884                 else\r
2885                 {\r
2886                         $skinFile = $skinFileRaw;\r
2887                 }\r
2888                 \r
2889                 // read only metadata\r
2890                 $error = $importer->readFile($skinFile, 1);\r
2891                 \r
2892                 /* TODO: we should consider to use the other way insterad of this */\r
2893                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2894                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2895                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2896                 \r
2897                 // clashes\r
2898                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2899                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2900                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2901                 \r
2902                 /* TODO: we should consider to use the other way insterad of this */\r
2903                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2904                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2905                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2906                 \r
2907                 if ( $error )\r
2908                 {\r
2909                         self::error($error);\r
2910                 }\r
2911                 \r
2912                 self::$skin->parse('skinieimport');\r
2913                 return;\r
2914         }\r
2915         \r
2916         /**\r
2917          * Admin::action_skiniedoimport()\r
2918          * \r
2919          * @param       void\r
2920          * @return      void\r
2921          */\r
2922         static private function action_skiniedoimport()\r
2923         {\r
2924                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2925                 \r
2926                 $member->isAdmin() or self::disallow();\r
2927                 \r
2928                 // load skinie class\r
2929                 include_once($DIR_LIBS . 'skinie.php');\r
2930                 \r
2931                 $skinFileRaw    = postVar('skinfile');\r
2932                 $mode                   = postVar('mode');\r
2933                 \r
2934                 $allowOverwrite = intPostVar('overwrite');\r
2935                 \r
2936                 // get full filename\r
2937                 if ( $mode == 'file' )\r
2938                 {\r
2939                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2940                         \r
2941                         /* TODO: remove this\r
2942                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2943                         if ( !file_exists($skinFile) )\r
2944                         {\r
2945                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2946                         }\r
2947                         */\r
2948                 }\r
2949                 else\r
2950                 {\r
2951                         $skinFile = $skinFileRaw;\r
2952                 }\r
2953                 \r
2954                 $importer = new SkinImport();\r
2955                 \r
2956                 $error = $importer->readFile($skinFile);\r
2957                 \r
2958                 if ( $error )\r
2959                 {\r
2960                         self::error($error);\r
2961                 }\r
2962                 \r
2963                 $error = $importer->writeToDatabase($allowOverwrite);\r
2964                 \r
2965                 if ( $error )\r
2966                 {\r
2967                         self::error($error);\r
2968                 }\r
2969                 \r
2970                 /* TODO: we should consider to use the other way insterad of this */\r
2971                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2972                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2973                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2974                 \r
2975                 self::$skin->parse('skiniedoimport');\r
2976                 return;\r
2977         }\r
2978 \r
2979         /**\r
2980          * Admin::action_skinieexport()\r
2981          * \r
2982          * @param       void\r
2983          * @return      void\r
2984          */\r
2985         static private function action_skinieexport()\r
2986         {\r
2987                 global $member, $DIR_LIBS;\r
2988                 \r
2989                 $member->isAdmin() or self::disallow();\r
2990                 \r
2991                 // load skinie class\r
2992                 include_once($DIR_LIBS . 'skinie.php');\r
2993                 \r
2994                 $aSkins         = requestIntArray('skin');\r
2995                 $aTemplates     = requestIntArray('template');\r
2996                 \r
2997                 if ( !is_array($aTemplates) )\r
2998                 {\r
2999                         $aTemplates = array();\r
3000                 }\r
3001                 if ( !is_array($aSkins) )\r
3002                 {\r
3003                         $aSkins = array();\r
3004                 }\r
3005                 \r
3006                 $skinList               = array_keys($aSkins);\r
3007                 $templateList   = array_keys($aTemplates);\r
3008                 \r
3009                 $info = postVar('info');\r
3010                 \r
3011                 $exporter = new SkinExport();\r
3012                 foreach ( $skinList as $skinId )\r
3013                 {\r
3014                         $exporter->addSkin($skinId);\r
3015                 }\r
3016                 foreach ($templateList as $templateId)\r
3017                 {\r
3018                         $exporter->addTemplate($templateId);\r
3019                 }\r
3020                 $exporter->setInfo($info);\r
3021                 \r
3022                 $exporter->export();\r
3023                 return;\r
3024         }\r
3025         \r
3026         /**\r
3027          * Admin::action_templateoverview()\r
3028          * \r
3029          * @param       void\r
3030          * @return      void\r
3031          */\r
3032         static private function action_templateoverview()\r
3033         {\r
3034                 global $member, $manager;\r
3035                 \r
3036                 $member->isAdmin() or self::disallow();\r
3037                 \r
3038                 self::$skin->parse('templateoverview');\r
3039                 return;\r
3040         }\r
3041         \r
3042         /**\r
3043          * Admin::action_templateedit()\r
3044          * \r
3045          * @param       string  $msg    message for pageheader\r
3046          * @return      void\r
3047          */\r
3048         static private function action_templateedit($msg = '')\r
3049         {\r
3050                 global $member, $manager;\r
3051                 if ( $msg )\r
3052                 {\r
3053                         self::$headMess = $msg;\r
3054                 }\r
3055                 \r
3056                 $templateid = intRequestVar('templateid');\r
3057                 \r
3058                 $member->isAdmin() or self::disallow();\r
3059                 \r
3060                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3061                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3062                 \r
3063                 self::$skin->parse('templateedit');\r
3064                 return;\r
3065         }\r
3066         \r
3067         /**\r
3068          * Admin::action_templateupdate()\r
3069          * \r
3070          * @param       void\r
3071          * @return      void\r
3072          */\r
3073         static private function action_templateupdate()\r
3074         {\r
3075                 global $member,$manager;\r
3076                 \r
3077                 $templateid = intRequestVar('templateid');\r
3078                 \r
3079                 $member->isAdmin() or self::disallow();\r
3080                 \r
3081                 $name = postVar('tname');\r
3082                 $desc = postVar('tdesc');\r
3083                 \r
3084                 if ( !isValidTemplateName($name) )\r
3085                 {\r
3086                         self::error(_ERROR_BADTEMPLATENAME);\r
3087                 }\r
3088                 \r
3089                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3090                 {\r
3091                         self::error(_ERROR_DUPTEMPLATENAME);\r
3092                 }\r
3093                 \r
3094                 // 1. Remove all template parts\r
3095                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3096                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3097                 DB::execute($query);\r
3098                 \r
3099                 // 2. Update description\r
3100                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3101                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3102                 DB::execute($query);\r
3103                 \r
3104                 // 3. Add non-empty template parts\r
3105                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3106                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3107                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3108                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3109                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3110                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3111                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3114                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3115                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3116                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3117                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3118                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3119                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3120                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3121                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3122                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3123                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3124                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3125                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3126                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3127                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3128                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3129                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3130                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3131                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3132                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3133                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3134                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3135                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3136                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3137                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3138                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3139                 \r
3140                 $data = array('fields' => array());\r
3141                 $manager->notify('TemplateExtraFields', $data);\r
3142                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3143                 {\r
3144                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3145                         {\r
3146                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3147                         }\r
3148                 }\r
3149                 \r
3150                 // jump back to template edit\r
3151                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3152                 return;\r
3153         }\r
3154         \r
3155         /**\r
3156          * Admin::addToTemplate()\r
3157          * \r
3158          * @param       Integer $id     ID for template\r
3159          * @param       String  $partname       parts name\r
3160          * @param       String  $content        template contents\r
3161          * @return      Integer record index\r
3162          * \r
3163          */\r
3164         static private function addToTemplate($id, $partname, $content)\r
3165         {\r
3166                 // don't add empty parts:\r
3167                 if ( !trim($content) )\r
3168                 {\r
3169                         return -1;\r
3170                 }\r
3171                 \r
3172                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3173                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3174                 if ( DB::execute($query) === FALSE )\r
3175                 {\r
3176                         $err = DB::getError();\r
3177                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3178                 }\r
3179                 return DB::getInsertId();\r
3180         }\r
3181         \r
3182         /**\r
3183          * Admin::action_templatedelete()\r
3184          * \r
3185          * @param       void\r
3186          * @return      void\r
3187          */\r
3188         static private function action_templatedelete()\r
3189         {\r
3190                 global $member, $manager;\r
3191                 \r
3192                 $member->isAdmin() or self::disallow();\r
3193                 \r
3194                 $templateid = intRequestVar('templateid');\r
3195                 // TODO: check if template can be deleted\r
3196                 \r
3197                 self::$skin->parse('templatedelete');\r
3198                 return;\r
3199         }\r
3200         \r
3201         /**\r
3202          * Admin::action_templatedeleteconfirm()\r
3203          * \r
3204          * @param       void\r
3205          * @return      void\r
3206          */\r
3207         static private function action_templatedeleteconfirm()\r
3208         {\r
3209                 global $member, $manager;\r
3210                 \r
3211                 $templateid = intRequestVar('templateid');\r
3212                 \r
3213                 $member->isAdmin() or self::disallow();\r
3214                 \r
3215                 $data = array('templateid' => $templateid);\r
3216                 $manager->notify('PreDeleteTemplate', $data);\r
3217                 \r
3218                 // 1. delete description\r
3219                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3220                 \r
3221                 // 2. delete parts\r
3222                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3223                 \r
3224                 \r
3225                 $data = array('templateid' => $templateid);\r
3226                 $manager->notify('PostDeleteTemplate', $data);\r
3227                 \r
3228                 self::action_templateoverview();\r
3229                 return;\r
3230         }\r
3231         \r
3232         /**\r
3233          * Admin::action_templatenew()\r
3234          * \r
3235          * @param       void\r
3236          * @return      void\r
3237          */\r
3238         static private function action_templatenew()\r
3239         {\r
3240                 global $member;\r
3241                 \r
3242                 $member->isAdmin() or self::disallow();\r
3243                 \r
3244                 $name = postVar('name');\r
3245                 $desc = postVar('desc');\r
3246                 \r
3247                 if ( !isValidTemplateName($name) )\r
3248                 {\r
3249                         self::error(_ERROR_BADTEMPLATENAME);\r
3250                 }\r
3251                 \r
3252                 if ( Template::exists($name) )\r
3253                 {\r
3254                         self::error(_ERROR_DUPTEMPLATENAME);\r
3255                 }\r
3256                 \r
3257                 $newTemplateId = Template::createNew($name, $desc);\r
3258                 \r
3259                 self::action_templateoverview();\r
3260                 return;\r
3261         }\r
3262         \r
3263         /**\r
3264          * Admin::action_templateclone()\r
3265          * \r
3266          * @param       void\r
3267          * @return      void\r
3268          */\r
3269         static private function action_templateclone()\r
3270         {\r
3271                 global $member;\r
3272                 \r
3273                 $templateid = intRequestVar('templateid');\r
3274                 \r
3275                 $member->isAdmin() or self::disallow();\r
3276                 \r
3277                 // 1. read old template\r
3278                 $name = Template::getNameFromId($templateid);\r
3279                 $desc = Template::getDesc($templateid);\r
3280                 \r
3281                 // 2. create desc thing\r
3282                 $name = "cloned" . $name;\r
3283                 \r
3284                 // if a template with that name already exists:\r
3285                 if ( Template::exists($name) )\r
3286                 {\r
3287                         $i = 1;\r
3288                         while (Template::exists($name . $i))\r
3289                         {\r
3290                                 $i++;\r
3291                         }\r
3292                         $name .= $i;\r
3293                 }\r
3294                 \r
3295                 $newid = Template::createNew($name, $desc);\r
3296                 \r
3297                 // 3. create clone\r
3298                 // go through parts of old template and add them to the new one\r
3299                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3300                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3301                 \r
3302                 $res = DB::getResult($query);\r
3303                 foreach ( $res as $row)\r
3304                 {\r
3305                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3306                 }\r
3307                 \r
3308                 self::action_templateoverview();\r
3309                 return;\r
3310         }\r
3311         \r
3312         /**\r
3313          * Admin::action_admintemplateoverview()\r
3314          * \r
3315          * @param       void\r
3316          * @return      void\r
3317          */\r
3318         static private function action_admintemplateoverview()\r
3319         {\r
3320                 global $member;\r
3321                 $member->isAdmin() or self::disallow();\r
3322                 self::$skin->parse('admntemplateoverview');\r
3323                 return;\r
3324         }\r
3325         \r
3326         /**\r
3327          * Admin::action_admintemplateedit()\r
3328          * \r
3329          * @param       string  $msg    message for pageheader\r
3330          * @return      void\r
3331          */\r
3332         static private function action_admintemplateedit($msg = '')\r
3333         {\r
3334                 global $member, $manager;\r
3335                 if ( $msg )\r
3336                 {\r
3337                         self::$headMess = $msg;\r
3338                 }\r
3339                 $member->isAdmin() or self::disallow();\r
3340                 \r
3341                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(javascript/templateEdit.js)%>\"></script>\n";\r
3342                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3343                 \r
3344                 self::$skin->parse('admintemplateedit');\r
3345                 return;\r
3346         }\r
3347         \r
3348         /**\r
3349          * Admin::action_admintemplateupdate()\r
3350          * \r
3351          * @param       void\r
3352          * @return      void\r
3353          */\r
3354         static private function action_admintemplateupdate()\r
3355         {\r
3356                 global $member, $manager;\r
3357                 $templateid = intRequestVar('templateid');\r
3358                 $member->isAdmin() or self::disallow();\r
3359                 $name = postVar('tname');\r
3360                 $desc = postVar('tdesc');\r
3361                 \r
3362                 if ( !isValidTemplateName($name) )\r
3363                 {\r
3364                         self::error(_ERROR_BADTEMPLATENAME);\r
3365                 }\r
3366                 \r
3367                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3368                 {\r
3369                         self::error(_ERROR_DUPTEMPLATENAME);\r
3370                 }\r
3371                 \r
3372                 // 1. Remove all template parts\r
3373                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3374                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3375                 DB::execute($query);\r
3376                 \r
3377                 // 2. Update description\r
3378                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3379                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3380                 DB::execute($query);\r
3381                 \r
3382                 // 3. Add non-empty template parts\r
3383                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3384                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3385                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3386                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3387                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3388                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3389                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3390                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3391                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3392                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3393                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3394                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3395                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3396                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3397                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3399                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3400                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3401                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3402                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3403                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3404                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3405                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3406                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3407                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3408                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3409                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3410                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3411                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3478                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3479                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3480                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3484                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3485                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3486                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3487                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3488                 \r
3489                 $data = array('fields' => array());\r
3490                 $manager->notify('AdminTemplateExtraFields', $data);\r
3491                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3492                 {\r
3493                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3494                         {\r
3495                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3496                         }\r
3497                 }\r
3498                 \r
3499                 // jump back to template edit\r
3500                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3501                 return;\r
3502         }\r
3503         \r
3504         /**\r
3505          * Admin::addToAdminTemplate()\r
3506          * \r
3507          * @param       integer $id                     ID for template\r
3508          * @param       string  $partname       name of part for template\r
3509          * @param       void    $contents       content for part of template\r
3510          * @return      integer ID for newly inserted Template\r
3511          */\r
3512         static private function addToAdminTemplate($id, $partname, $content)\r
3513         {\r
3514                 // don't add empty parts:\r
3515                 if ( !trim($content) )\r
3516                 {\r
3517                         return -1;\r
3518                 }\r
3519                 \r
3520                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3521                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3522                 if ( DB::execute($query) === FALSE )\r
3523                 {\r
3524                         $err = DB::getError();\r
3525                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3526                 }\r
3527                 return DB::getInsertId();\r
3528         }\r
3529         \r
3530         /**\r
3531          * Admin::action_admintemplatedelete()\r
3532          * \r
3533          * @param       void\r
3534          * @return      void\r
3535          */\r
3536         static private function action_admintemplatedelete()\r
3537         {\r
3538                 global $member, $manager;\r
3539                 $member->isAdmin() or self::disallow();\r
3540                 \r
3541                 // TODO: check if template can be deleted\r
3542                 self::$skin->parse('admintemplatedelete');\r
3543                 return;\r
3544         }\r
3545         \r
3546         /**\r
3547          * Admin::action_admintemplatedeleteconfirm()\r
3548          * \r
3549          * @param       void\r
3550          * @return      void\r
3551          */\r
3552         static private function action_admintemplatedeleteconfirm()\r
3553         {\r
3554                 global $member, $manager;\r
3555                 \r
3556                 $templateid = intRequestVar('templateid');\r
3557                 $member->isAdmin() or self::disallow();\r
3558                 \r
3559                 $data = array('templateid' => $templateid);\r
3560                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3561                 \r
3562                 // 1. delete description\r
3563                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3564                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3565                 DB::execute($query);\r
3566                 \r
3567                 // 2. delete parts\r
3568                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3569                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3570                 DB::execute($query);\r
3571                 \r
3572                 $data = array('templateid' => $templateid);\r
3573                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3574                 \r
3575                 self::action_admintemplateoverview();\r
3576                 return;\r
3577         }\r
3578         \r
3579         /**\r
3580          * Admin::action_admintemplatenew()\r
3581          * \r
3582          * @param       void\r
3583          * @return      void\r
3584          */\r
3585         static private function action_admintemplatenew()\r
3586         {\r
3587                 global $member;\r
3588                 $member->isAdmin() or self::disallow();\r
3589                 $name = postVar('name');\r
3590                 $desc = postVar('desc');\r
3591                 \r
3592                 if ( !isValidTemplateName($name) )\r
3593                 {\r
3594                         self::error(_ERROR_BADTEMPLATENAME);\r
3595                 }\r
3596                 else if ( !preg_match('#^admin/#', $name) )\r
3597                 {\r
3598                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3599                 }\r
3600                 else if ( Template::exists($name) )\r
3601                 {\r
3602                         self::error(_ERROR_DUPTEMPLATENAME);\r
3603                 }\r
3604                 \r
3605                 $newTemplateId = Template::createNew($name, $desc);\r
3606                 self::action_admintemplateoverview();\r
3607                 return;\r
3608         }\r
3609         \r
3610         /**\r
3611          * Admin::action_admintemplateclone()\r
3612          * \r
3613          * @param       void\r
3614          * @return      void\r
3615          */\r
3616         static private function action_admintemplateclone()\r
3617         {\r
3618                 global $member;\r
3619                 $templateid = intRequestVar('templateid');\r
3620                 $member->isAdmin() or self::disallow();\r
3621                 \r
3622                 // 1. read old template\r
3623                 $name = Template::getNameFromId($templateid);\r
3624                 $desc = Template::getDesc($templateid);\r
3625                 \r
3626                 // 2. create desc thing\r
3627                 $name = $name . "cloned";\r
3628                 \r
3629                 // if a template with that name already exists:\r
3630                 if ( Template::exists($name) )\r
3631                 {\r
3632                         $i = 1;\r
3633                         while ( Template::exists($name . $i) )\r
3634                         {\r
3635                                 $i++;\r
3636                         }\r
3637                         $name .= $i;\r
3638                 }\r
3639                 \r
3640                 $newid = Template::createNew($name, $desc);\r
3641                 \r
3642                 // 3. create clone\r
3643                 // go through parts of old template and add them to the new one\r
3644                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3645                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3646                 \r
3647                 $res = DB::getResult($query);\r
3648                 foreach ( $res as $row )\r
3649                 {\r
3650                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3651                 }\r
3652                 \r
3653                 self::action_admintemplateoverview();\r
3654                 return;\r
3655         }\r
3656 \r
3657         /**\r
3658          * Admin::action_skinoverview()\r
3659          * \r
3660          * @param       void\r
3661          * @return      void\r
3662          */\r
3663         static private function action_skinoverview()\r
3664         {\r
3665                 global $member, $manager;\r
3666                 \r
3667                 $member->isAdmin() or self::disallow();\r
3668                 \r
3669                 self::$skin->parse('skinoverview');\r
3670                 return;\r
3671         }\r
3672         \r
3673         /**\r
3674          * Admin::action_skinnew()\r
3675          * \r
3676          * @param       void\r
3677          * @return      void\r
3678          */\r
3679         static private function action_skinnew()\r
3680         {\r
3681                 global $member;\r
3682                 \r
3683                 $member->isAdmin() or self::disallow();\r
3684                 \r
3685                 $name = trim(postVar('name'));\r
3686                 $desc = trim(postVar('desc'));\r
3687                 \r
3688                 if ( !isValidSkinName($name) )\r
3689                 {\r
3690                         self::error(_ERROR_BADSKINNAME);\r
3691                 }\r
3692                 \r
3693                 if ( SKIN::exists($name) )\r
3694                 {\r
3695                         self::error(_ERROR_DUPSKINNAME);\r
3696                 }\r
3697                 \r
3698                 $newId = SKIN::createNew($name, $desc);\r
3699                 \r
3700                 self::action_skinoverview();\r
3701                 return;\r
3702         }\r
3703         \r
3704         /**\r
3705          * Admin::action_skinedit()\r
3706          * \r
3707          * @param       void\r
3708          * @return      void\r
3709          */\r
3710         static private function action_skinedit()\r
3711         {\r
3712                 global $member, $manager;\r
3713                 \r
3714                 $member->isAdmin() or self::disallow();\r
3715                 \r
3716                 self::$skin->parse('skinedit');\r
3717                 return;\r
3718         }\r
3719         \r
3720         /**\r
3721          * Admin::action_skineditgeneral()\r
3722          * \r
3723          * @param       void\r
3724          * @return      void\r
3725          */\r
3726         static private function action_skineditgeneral()\r
3727         {\r
3728                 global $manager, $member;\r
3729                 \r
3730                 $skinid = intRequestVar('skinid');\r
3731                 \r
3732                 $member->isAdmin() or self::disallow();\r
3733                 \r
3734                 $name           = postVar('name');\r
3735                 $desc           = postVar('desc');\r
3736                 $type           = postVar('type');\r
3737                 $inc_mode       = postVar('inc_mode');\r
3738                 $inc_prefix     = postVar('inc_prefix');\r
3739                 \r
3740                 $skin =& $manager->getSkin($skinid);\r
3741                 \r
3742                 // 1. Some checks\r
3743                 if ( !isValidSkinName($name) )\r
3744                 {\r
3745                         self::error(_ERROR_BADSKINNAME);\r
3746                 }\r
3747                 \r
3748                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3749                 {\r
3750                         self::error(_ERROR_DUPSKINNAME);\r
3751                 }\r
3752                 \r
3753                 if ( !$type )\r
3754                 {\r
3755                         $type = 'text/html';\r
3756                 }\r
3757                 if ( !$inc_mode )\r
3758                 {\r
3759                         $inc_mode = 'normal';\r
3760                 }\r
3761                 \r
3762                 // 2. Update description\r
3763                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3764                 \r
3765                 self::action_skinedit();\r
3766                 return;\r
3767         }\r
3768         \r
3769         static private function action_skinedittype($msg = '')\r
3770         {\r
3771                 global $member, $manager;\r
3772                 \r
3773                 $member->isAdmin() or self::disallow();\r
3774                 \r
3775                 if ( $msg )\r
3776                 {\r
3777                         self::$headMess = $msg;\r
3778                 }\r
3779                 \r
3780                 $skinid = intRequestVar('skinid');\r
3781                 $type   = requestVar('type');\r
3782                 $type   = trim($type);\r
3783                 $type   = strtolower($type);\r
3784                 \r
3785                 if ( !isValidShortName($type) )\r
3786                 {\r
3787                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3788                 }\r
3789                 \r
3790                 self::$skin->parse('skinedittype');\r
3791                 return;\r
3792         }\r
3793         \r
3794         /**\r
3795          * Admin::action_skinupdate()\r
3796          * \r
3797          * @param       void\r
3798          * @return      void\r
3799          */\r
3800         static private function action_skinupdate()\r
3801         {\r
3802                 global $manager, $member;\r
3803                 \r
3804                 $skinid = intRequestVar('skinid');\r
3805                 $content = trim(postVar('content'));\r
3806                 $type = postVar('type');\r
3807                 \r
3808                 $member->isAdmin() or self::disallow();\r
3809                 \r
3810                 $skin =& $manager->getSKIN($skinid);\r
3811                 $skin->update($type, $content);\r
3812                 \r
3813                 self::action_skinedittype(_SKIN_UPDATED);\r
3814                 return;\r
3815         }\r
3816         \r
3817         /**\r
3818          * Admin::action_skindelete()\r
3819          * \r
3820          * @param       void\r
3821          * @return      void\r
3822          */\r
3823         static private function action_skindelete()\r
3824         {\r
3825                 global $manager, $member, $CONF;\r
3826                 \r
3827                 $skinid = intRequestVar('skinid');\r
3828                 \r
3829                 $member->isAdmin() or self::disallow();\r
3830                 \r
3831                 // don't allow default skin to be deleted\r
3832                 if ( $skinid == $CONF['BaseSkin'] )\r
3833                 {\r
3834                         self::error(_ERROR_DEFAULTSKIN);\r
3835                 }\r
3836                 \r
3837                 // don't allow deletion of default skins for blogs\r
3838                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3839                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3840                 \r
3841                 $name = DB::getValue($query);\r
3842                 if ( $name )\r
3843                 {\r
3844                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3845                 }\r
3846                 \r
3847                 self::$skin->parse('skindelete');\r
3848                 return;\r
3849         }\r
3850         \r
3851         /**\r
3852          * Admin::action_skindeleteconfirm()\r
3853          * \r
3854          * @param       void\r
3855          * @return      void\r
3856          */\r
3857         static private function action_skindeleteconfirm()\r
3858         {\r
3859                 global $member, $CONF, $manager;\r
3860                 \r
3861                 $skinid = intRequestVar('skinid');\r
3862                 \r
3863                 $member->isAdmin() or self::disallow();\r
3864                 \r
3865                 // don't allow default skin to be deleted\r
3866                 if ( $skinid == $CONF['BaseSkin'] )\r
3867                 {\r
3868                         self::error(_ERROR_DEFAULTSKIN);\r
3869                 }\r
3870                 \r
3871                 // don't allow deletion of default skins for blogs\r
3872                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3873                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3874                 \r
3875                 $name = DB::getValue($query);\r
3876                 if ( $name )\r
3877                                 {\r
3878                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3879                 }\r
3880                 \r
3881                 $data = array('skinid' => $skinid);\r
3882                 $manager->notify('PreDeleteSkin', $data);\r
3883                 \r
3884                 // 1. delete description\r
3885                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3886                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3887                 DB::execute($query);\r
3888                 \r
3889                 // 2. delete parts\r
3890                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3891                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3892                 DB::execute($query);\r
3893                 \r
3894                 $data = array('skinid' => $skinid);\r
3895                 $manager->notify('PostDeleteSkin', $data);\r
3896                 \r
3897                 self::action_skinoverview();\r
3898                 return;\r
3899         }\r
3900         \r
3901         /**\r
3902          * Admin::action_skinremovetype()\r
3903          * \r
3904          * @param       void\r
3905          * @return      void\r
3906          */\r
3907         static private function action_skinremovetype()\r
3908         {\r
3909                 global $member, $manager, $CONF;\r
3910                 \r
3911                 $member->isAdmin() or self::disallow();\r
3912                 \r
3913                 $skinid = intRequestVar('skinid');\r
3914                 $skintype = requestVar('type');\r
3915                 \r
3916                 if ( !isValidShortName($skintype) )\r
3917                 {\r
3918                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3919                 }\r
3920                 \r
3921                 // don't allow default skinparts to be deleted\r
3922                 /* TODO: this array should be retrieved from Action class */\r
3923                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3924                 {\r
3925                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3926                 }\r
3927                 \r
3928                 self::$skin->parse('skinremovetype');\r
3929                 return;\r
3930         }\r
3931         \r
3932         /**\r
3933          * Admin::action_skinremovetypeconfirm()\r
3934          * \r
3935          * @param       void\r
3936          * @return      void\r
3937          */\r
3938         static private function action_skinremovetypeconfirm()\r
3939         {\r
3940                 global $member, $CONF, $manager;\r
3941                 \r
3942                 $member->isAdmin() or self::disallow();\r
3943                 \r
3944                 $skinid = intRequestVar('skinid');\r
3945                 $skintype = requestVar('type');\r
3946                 \r
3947                 if ( !isValidShortName($skintype) )\r
3948                 {\r
3949                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3950                 }\r
3951                 \r
3952                 // don't allow default skinparts to be deleted\r
3953                 /* TODO: this array should be retrieved from Action class */\r
3954                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3955                 {\r
3956                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3957                 }\r
3958                 \r
3959                 $data = array(\r
3960                         'skinid'   => $skinid,\r
3961                         'skintype' => $skintype\r
3962                 );\r
3963                 $manager->notify('PreDeleteSkinPart', $data);\r
3964                 // delete part\r
3965                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3966                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3967                 DB::execute($query);\r
3968                 \r
3969                 $data = array(\r
3970                         'skinid'   => $skinid,\r
3971                         'skintype' => $skintype\r
3972                 );\r
3973                 $manager->notify('PostDeleteSkinPart', $data);\r
3974                 \r
3975                 self::action_skinedit();\r
3976                 return;\r
3977         }\r
3978 \r
3979         /**\r
3980          * Admin::action_skinclone()\r
3981          * \r
3982          * @param       void\r
3983          * @return      void\r
3984          */\r
3985         static private function action_skinclone()\r
3986         {\r
3987                 global $manager, $member;\r
3988                 \r
3989                 $member->isAdmin() or self::disallow();\r
3990                 \r
3991                 $skinid = intRequestVar('skinid');\r
3992                 \r
3993                 // 1. read skin to clone\r
3994                 $skin =& $manager->getSkin($skinid);\r
3995                 \r
3996                 $name = "{$skin->getName()}_clone";\r
3997                 \r
3998                 // if a skin with that name already exists:\r
3999                 if ( Skin::exists($name) )\r
4000                 {\r
4001                         $i = 1;\r
4002                         while ( Skin::exists($name . $i) )\r
4003                         {\r
4004                                 $i++;\r
4005                         }\r
4006                         $name .= $i;\r
4007                 }\r
4008                 \r
4009                 // 2. create skin desc\r
4010                 $newid = Skin::createNew(\r
4011                         $name,\r
4012                         $skin->getDescription(),\r
4013                         $skin->getContentType(),\r
4014                         $skin->getIncludeMode(),\r
4015                         $skin->getIncludePrefix()\r
4016                 );\r
4017                 \r
4018                 // 3. clone\r
4019                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4020                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4021                 \r
4022                 $res = DB::getResult($query);\r
4023                 foreach ( $res as $row )\r
4024                 {\r
4025                         self::skinclonetype($skin, $newid, $row['stype']);\r
4026                 }\r
4027                 \r
4028                 self::action_skinoverview();\r
4029                 return;\r
4030         }\r
4031         \r
4032         /**\r
4033          * Admin::skinclonetype()\r
4034          * \r
4035          * @param       String  $skin   Skin object\r
4036          * @param       Integer $newid  ID for this clone\r
4037          * @param       String  $type   type of skin\r
4038          * @return      Void\r
4039          */\r
4040         static private function skinclonetype($skin, $newid, $type)\r
4041         {\r
4042                 $newid = intval($newid);\r
4043                 $content = $skin->getContentFromDB($type);\r
4044                 \r
4045                 if ( $content )\r
4046                 {\r
4047                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4048                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4049                         DB::execute($query);\r
4050                 }\r
4051                 return;\r
4052         }\r
4053         \r
4054         /**\r
4055          * Admin::action_adminskinoverview()\r
4056          * \r
4057          * @param       void\r
4058          * @return      void\r
4059          */\r
4060         static private function action_adminskinoverview()\r
4061         {\r
4062                 global $member, $manager;\r
4063                 \r
4064                 $member->isAdmin() or self::disallow();\r
4065                 \r
4066                 self::$skin->parse('adminskinoverview');\r
4067                 return;\r
4068         }\r
4069         \r
4070         /**\r
4071          * Admin::action_adminskinnew()\r
4072          * \r
4073          * @param       void\r
4074          * @return      void\r
4075          */\r
4076         static private function action_adminskinnew()\r
4077         {\r
4078                 global $member;\r
4079                 $member->isAdmin() or self::disallow();\r
4080                 $name = trim(postVar('name'));\r
4081                 $desc = trim(postVar('desc'));\r
4082                 \r
4083                 if ( !isValidSkinName($name) )\r
4084                 {\r
4085                         self::error(_ERROR_BADSKINNAME);\r
4086                 }\r
4087                 else if ( !preg_match('#^admin/#', $name) )\r
4088                 {\r
4089                         self::error(_ERROR_BADADMINSKINNAME);\r
4090                 }\r
4091                 else if ( Skin::exists($name) )\r
4092                 {\r
4093                         self::error(_ERROR_DUPSKINNAME);\r
4094                 }\r
4095                 /* TODO: $newId is not reused... */\r
4096                 $newId = Skin::createNew($name, $desc);\r
4097                 self::action_adminskinoverview();\r
4098                 return;\r
4099         }\r
4100         \r
4101         /**\r
4102          * Admin::action_adminskinedit()\r
4103          * \r
4104          * @param       void\r
4105          * @return      void\r
4106          */\r
4107         static private function action_adminskinedit()\r
4108         {\r
4109                 global $member, $manager;\r
4110                 \r
4111                 $member->isAdmin() or self::disallow();\r
4112                 self::$skin->parse('adminskinedit');\r
4113                 return;\r
4114         }\r
4115         \r
4116         /**\r
4117          * Admin::action_adminskineditgeneral()\r
4118          * \r
4119          * @param       void\r
4120          * @return      void\r
4121          */\r
4122         static private function action_adminskineditgeneral()\r
4123         {\r
4124                 global $manager, $member;\r
4125                 \r
4126                 $skinid = intRequestVar('skinid');\r
4127                 \r
4128                 $member->isAdmin() or self::disallow();\r
4129                 \r
4130                 $name           = postVar('name');\r
4131                 $desc           = postVar('desc');\r
4132                 $type           = postVar('type');\r
4133                 $inc_mode       = postVar('inc_mode');\r
4134                 $inc_prefix     = postVar('inc_prefix');\r
4135                 \r
4136                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4137                 \r
4138                 // 1. Some checks\r
4139                 if ( !isValidSkinName($name) )\r
4140                 {\r
4141                         self::error(_ERROR_BADSKINNAME);\r
4142                 }\r
4143                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4144                 {\r
4145                         self::error(_ERROR_DUPSKINNAME);\r
4146                 }\r
4147                 if ( !$type )\r
4148                 {\r
4149                         $type = 'text/html';\r
4150                 }\r
4151                 if ( !$inc_mode )\r
4152                 {\r
4153                         $inc_mode = 'normal';\r
4154                 }\r
4155                 // 2. Update description\r
4156                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4157                 self::action_adminskinedit();\r
4158                 return;\r
4159         }\r
4160         \r
4161         /**\r
4162          * Admin::action_adminskinedittype()\r
4163          * \r
4164          * @param       string  $msg    message for pageheader\r
4165          * @return      void\r
4166          */\r
4167         static private function action_adminskinedittype($msg = '')\r
4168         {\r
4169                 global $member, $manager;\r
4170                 \r
4171                 $member->isAdmin() or self::disallow();\r
4172                 \r
4173                 if ( $msg )\r
4174                 {\r
4175                         self::$headMess = $msg;\r
4176                 }\r
4177                 $type = requestVar('type');\r
4178                 $type = trim($type);\r
4179                 $type = strtolower($type);\r
4180                 \r
4181                 if ( !isValidShortName($type) )\r
4182                 {\r
4183                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4184                 }\r
4185                 \r
4186                 self::$skin->parse('adminskinedittype');\r
4187                 return;\r
4188         }\r
4189         \r
4190         /**\r
4191          * Admin::action_adminskinupdate()\r
4192          * \r
4193          * @param       void\r
4194          * @return      void\r
4195          */\r
4196         static private function action_adminskinupdate()\r
4197         {\r
4198                 global $manager, $member;\r
4199                 \r
4200                 $skinid = intRequestVar('skinid');\r
4201                 $content = trim(postVar('content'));\r
4202                 $type = postVar('type');\r
4203                 \r
4204                 $member->isAdmin() or self::disallow();\r
4205                 \r
4206                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4207                 $skin->update($type, $content);\r
4208                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4209                 return;\r
4210         }\r
4211         \r
4212         /**\r
4213          * Admin::action_adminskindelete()\r
4214          * \r
4215          * @param       void\r
4216          * @return      void\r
4217          */\r
4218         static private function action_adminskindelete()\r
4219         {\r
4220                 global $member, $manager, $CONF;\r
4221                 $member->isAdmin() or self::disallow();\r
4222                 \r
4223                 /* TODO: needless variable $skinid... */\r
4224                 $skinid = intRequestVar('skinid');\r
4225                 self::$skin->parse('adminskindelete');\r
4226                 return;\r
4227         }\r
4228 \r
4229         /**\r
4230          * Admin::action_adminskindeleteconfirm()\r
4231          * \r
4232          * @param       void\r
4233          * @return      void\r
4234          */\r
4235         static private function action_adminskindeleteconfirm()\r
4236         {\r
4237                 global $member, $CONF, $manager;\r
4238                 \r
4239                 $member->isAdmin() or self::disallow();\r
4240                 $skinid = intRequestVar('skinid');\r
4241                 \r
4242                 // don't allow default skin to be deleted\r
4243                 if ( $skinid == $CONF['AdminSkin'] )\r
4244                 {\r
4245                         self::error(_ERROR_DEFAULTSKIN);\r
4246                         exit;\r
4247                 }\r
4248                 \r
4249                 /*\r
4250                  * TODO: NOT Implemented\r
4251                  *  don't allow deletion of default skins for members\r
4252                  */\r
4253                 $query          = 'SELECT * FROM %s WHERE madminskin = %d or mbkmklt = %d';\r
4254                 $res            = DB::getResult(sprintf($query, sql_table('member'), $skinid, $skinid));\r
4255                 $members        = array();\r
4256                 while ( $row = $res->fetch() ) {\r
4257                         $members[] = $row['mrealname'];\r
4258                 }\r
4259                 if ( count($members) )\r
4260                 {\r
4261                         self::error(_ERROR_SKINDEFDELETE . implode(' ' . _AND . ' ', $members));\r
4262                         exit;\r
4263                 }\r
4264 \r
4265                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4266                 \r
4267                 // 1. delete description\r
4268                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4269                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4270                 DB::execute($query);\r
4271                 \r
4272                 // 2. delete parts\r
4273                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4274                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4275                 \r
4276                 DB::execute($query);\r
4277                 \r
4278                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4279                 self::action_adminskinoverview();\r
4280                 return;\r
4281         }\r
4282         \r
4283         /**\r
4284          * Admin::action_adminskinremovetype()\r
4285          * \r
4286          * @param       void\r
4287          * @return      void\r
4288          */\r
4289         static private function action_adminskinremovetype()\r
4290         {\r
4291                 global $member, $manager, $CONF;\r
4292 \r
4293                 $member->isAdmin() or self::disallow();\r
4294                 \r
4295                 $skinid         = intRequestVar('skinid');\r
4296                 $skintype       = requestVar('type');\r
4297                 \r
4298                 if ( !isValidShortName($skintype) )\r
4299                 {\r
4300                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4301                 }\r
4302                 \r
4303                 self::$skin->parse('adminskinremovetype');\r
4304                 return;\r
4305         }\r
4306         \r
4307         /**\r
4308          * Admin::action_adminskinremovetypeconfirm()\r
4309          * \r
4310          * @param       void\r
4311          * @return      void\r
4312          */\r
4313         static private function action_adminskinremovetypeconfirm()\r
4314         {\r
4315                 global $member, $CONF, $manager;\r
4316                 \r
4317                 $member->isAdmin() or self::disallow();\r
4318                 \r
4319                 $skinid         = intRequestVar('skinid');\r
4320                 $skintype       = requestVar('type');\r
4321                 \r
4322                 if ( !isValidShortName($skintype) )\r
4323                 {\r
4324                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4325                 }\r
4326                 \r
4327                 $data =array(\r
4328                         'skinid'        => $skinid,\r
4329                         'skintype'      => $skintype\r
4330                 );\r
4331                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4332 \r
4333                 // delete part\r
4334                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4335                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4336                 DB::execute($query);\r
4337                 \r
4338                 $data = array(\r
4339                         'skinid'        => $skinid,\r
4340                         'skintype'      => $skintype\r
4341                 );\r
4342                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4343                 \r
4344                 self::action_adminskinedit();\r
4345                 return;\r
4346         }\r
4347 \r
4348         /**\r
4349          * Admin::action_adminskinclone()\r
4350          * \r
4351          * @param       void\r
4352          * @return      void\r
4353          */\r
4354         static private function action_adminskinclone()\r
4355         {\r
4356                 global $manager, $member;\r
4357                 \r
4358                 $member->isAdmin() or self::disallow();\r
4359                 \r
4360                 $skinid = intRequestVar('skinid');\r
4361                 \r
4362                 // 1. read skin to clone\r
4363                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4364                 $name = "{$skin->getName()}_clone";\r
4365                 \r
4366                 // if a skin with that name already exists:\r
4367                 if ( Skin::exists($name) )\r
4368                 {\r
4369                         $i = 1;\r
4370                         while ( Skin::exists($name . $i) )\r
4371                         {\r
4372                                 $i++;\r
4373                         }\r
4374                         $name .= $i;\r
4375                 }\r
4376                 \r
4377                 // 2. create skin desc\r
4378                 $newid = Skin::createNew(\r
4379                         $name,\r
4380                         $skin->getDescription(),\r
4381                         $skin->getContentType(),\r
4382                         $skin->getIncludeMode(),\r
4383                         $skin->getIncludePrefix()\r
4384                 );\r
4385                 \r
4386                 // 3. clone\r
4387                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4388                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4389                 \r
4390                 $res = DB::getResult($query);\r
4391                 foreach ( $res as $row )\r
4392                 {\r
4393                         self::skinclonetype($skin, $newid, $row['stype']);\r
4394                 }\r
4395                 self::action_adminskinoverview();\r
4396                 return;\r
4397         }\r
4398         \r
4399         /**\r
4400          * Admin::adminskinclonetype()\r
4401          * \r
4402          * @param       string  $skin   an instance of Skin class\r
4403          * @param       integer $newid  ID for new skin\r
4404          * @param       string  $type   skin type\r
4405          * @return      void\r
4406          */\r
4407         static private function adminskinclonetype($skin, $newid, $type)\r
4408         {\r
4409                 $content = $skin->getContentFromDB($type);\r
4410                 \r
4411                 if ( $content )\r
4412                 {\r
4413                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4414                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4415                         DB::execute($query);\r
4416                 }\r
4417                 return;\r
4418         }\r
4419         \r
4420         /**\r
4421          * Admin::action_adminskinieoverview()\r
4422          * \r
4423          * @param       void\r
4424          * @return      void\r
4425          */\r
4426         static private function action_adminskinieoverview()\r
4427         {\r
4428                 global $member, $DIR_LIBS, $manager;\r
4429                 \r
4430                 $member->isAdmin() or self::disallow();\r
4431                 \r
4432                 // load skinie class\r
4433                 include_once($DIR_LIBS . 'skinie.php');\r
4434                 \r
4435                 self::$skin->parse('adminskinieoverview');\r
4436                 return;\r
4437         }\r
4438 \r
4439         /**\r
4440          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4441          * Admin::action_adminskinieimport()\r
4442          * \r
4443          * @param       void\r
4444          * @return      void\r
4445          */\r
4446         static private function action_adminskinieimport()\r
4447         {\r
4448                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4449                 \r
4450                 $member->isAdmin() or self::disallow();\r
4451                 \r
4452                 // load skinie class\r
4453                 include_once($DIR_LIBS . 'skinie.php');\r
4454                 \r
4455                 $skinFileRaw    = postVar('skinfile');\r
4456                 $mode                   = postVar('mode');\r
4457                 \r
4458                 $importer = new SKINIMPORT();\r
4459                 \r
4460                 // get full filename\r
4461                 if ( $mode == 'file' )\r
4462                 {\r
4463                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4464                         \r
4465                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4466                         if ( !file_exists($skinFile) )\r
4467                         {\r
4468                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4469                         }\r
4470                 }\r
4471                 else\r
4472                 {\r
4473                         $skinFile = $skinFileRaw;\r
4474                 }\r
4475                 \r
4476                 // read only metadata\r
4477                 $error = $importer->readFile($skinFile, 1);\r
4478                 if ( $error )\r
4479                 {\r
4480                         self::error($error);\r
4481                 }\r
4482                 \r
4483                 /* TODO: we should consider to use the other way instead of this */\r
4484                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4485                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4486                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4487                 \r
4488                 // clashes\r
4489                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4490                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4491                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4492                 /* TODO: we should consider to use the other way instead of this */\r
4493                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4494                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4495                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4496 \r
4497                 if ( !is_object(self::$skin) )\r
4498                 {\r
4499                         self::action_adminskiniedoimport();\r
4500                 }\r
4501                 else\r
4502                 {\r
4503                         self::$skin->parse('adminskinieimport');\r
4504                 }\r
4505                 return;\r
4506         }\r
4507         \r
4508         /**\r
4509          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4510          * Admin::action_adminskiniedoimport()\r
4511          * \r
4512          * @param       void\r
4513          * @return      void\r
4514          */\r
4515         static private function action_adminskiniedoimport()\r
4516         {\r
4517                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4518                 \r
4519                 $member->isAdmin() or self::disallow();\r
4520                 \r
4521                 // load skinie class\r
4522                 include_once($DIR_LIBS . 'skinie.php');\r
4523                 \r
4524                 $skinFileRaw    = postVar('skinfile');\r
4525                 $mode                   = postVar('mode');\r
4526                 $allowOverwrite = intPostVar('overwrite');\r
4527                 \r
4528                 // get full filename\r
4529                 if ( $mode == 'file' )\r
4530                 {\r
4531                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4532                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4533                         if ( !file_exists($skinFile) )\r
4534                         {\r
4535                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4536                         }\r
4537                 }\r
4538                 else\r
4539                 {\r
4540                         $skinFile = $skinFileRaw;\r
4541                 }\r
4542                 \r
4543                 $importer = new SKINIMPORT();\r
4544                 \r
4545                 $error = $importer->readFile($skinFile);\r
4546                 if ( $error )\r
4547                 {\r
4548                         self::error($error);\r
4549                 }\r
4550                 \r
4551                 $error = $importer->writeToDatabase($allowOverwrite);\r
4552                 if ( $error )\r
4553                 {\r
4554                         self::error($error);\r
4555                 }\r
4556                 \r
4557                 /* TODO: we should consider to use the other way instead of this */\r
4558                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4559                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4560                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4561                 \r
4562                 if ( !is_object(self::$skin) )\r
4563                 {\r
4564                         global $DIR_SKINS;\r
4565                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4566                         $query  = sprintf($query, sql_table('skin_desc'));\r
4567                         $res    = intval(DB::getValue($query));\r
4568                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4569                         $query  = sprintf($query, sql_table('config'), $res);\r
4570                         DB::execute($query);\r
4571                         $skin   =& $manager->Skin(0, 'AdminActions', 'AdminSkin');\r
4572                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4573                 }\r
4574                 else\r
4575                 {\r
4576                         self::$skin->parse('adminskiniedoimport');\r
4577                 }\r
4578                 return;\r
4579         }\r
4580 \r
4581         /**\r
4582          * Admin::action_adminskinieexport()\r
4583          * \r
4584          * @param       void\r
4585          * @return      void\r
4586          */\r
4587         static private function action_adminskinieexport()\r
4588         {\r
4589                 global $member, $DIR_PLUGINS;\r
4590                 \r
4591                 $member->isAdmin() or self::disallow();\r
4592                 \r
4593                 // load skinie class\r
4594                 $aSkins = requestIntArray('skin');\r
4595                 if (!is_array($aSkins)) {\r
4596                         $aSkins = array();\r
4597                 }\r
4598                 $skinList = array_keys($aSkins);\r
4599                 \r
4600                 $aTemplates = requestIntArray('template');\r
4601                 if (!is_array($aTemplates))\r
4602                 {\r
4603                         $aTemplates = array();\r
4604                 }\r
4605                 $templateList = array_keys($aTemplates);\r
4606                 \r
4607                 $info = postVar('info');\r
4608                 \r
4609                 include_libs('skinie.php');\r
4610                 $exporter = new SkinExport();\r
4611                 foreach ( $skinList as $skinId )\r
4612                 {\r
4613                         $exporter->addSkin($skinId);\r
4614                 }\r
4615                 foreach ( $templateList as $templateId )\r
4616                 {\r
4617                         $exporter->addTemplate($templateId);\r
4618                 }\r
4619                 $exporter->setInfo($info);\r
4620                 $exporter->export();\r
4621                 return;\r
4622         }\r
4623         \r
4624         /**\r
4625          * Admin::action_settingsedit()\r
4626          * \r
4627          * @param       Void\r
4628          * @return      Void\r
4629          */\r
4630         static private function action_settingsedit()\r
4631         {\r
4632                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4633                 \r
4634                 $member->isAdmin() or self::disallow();\r
4635                 \r
4636                 self::$skin->parse('settingsedit');\r
4637                 return;\r
4638         }\r
4639         \r
4640         /**\r
4641          * Admin::action_settingsupdate()\r
4642          * Update $CONFIG and redirect\r
4643          * \r
4644          * @param       void\r
4645          * @return      void\r
4646          */\r
4647         static private function action_settingsupdate()\r
4648         {\r
4649                 global $member, $CONF;\r
4650                 \r
4651                 $member->isAdmin() or self::disallow();\r
4652                 \r
4653                 // check if email address for admin is valid\r
4654                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4655                 {\r
4656                         self::error(_ERROR_BADMAILADDRESS);\r
4657                 }\r
4658                 \r
4659                 // save settings\r
4660                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4661                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4662                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4663                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4664                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4665                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4666                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4667                 self::updateConfig('Locale',                    postVar('Locale'));\r
4668                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4669                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4670                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4671                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4672                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4673                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4674                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4675                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4676                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4677                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4678                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4679                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4680                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4681                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4682                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4683                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4684                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4685                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4686                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4687                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4688                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4689                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4690                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4691                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4692                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4693                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4694                 self::updateConfig('AdminSkin',                 postVar('adminskin'));\r
4695                 self::updateConfig('BookmarkletSkin',   postVar('bookmarklet'));\r
4696 \r
4697                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4698                 // note that when changing cookie settings, this redirect might cause the user\r
4699                 // to have to log in again.\r
4700                 getConfig();\r
4701                 redirect($CONF['AdminURL'] . '?action=manage');\r
4702                 return;\r
4703         }\r
4704         \r
4705         /**\r
4706          * Admin::action_systemoverview()\r
4707          * Output system overview\r
4708          * \r
4709          * @param       void\r
4710          * @return      void\r
4711          */\r
4712         static private function action_systemoverview()\r
4713         {\r
4714                 self::$skin->parse('systemoverview');\r
4715                 return;\r
4716         }\r
4717         \r
4718         /**\r
4719          * Admin::updateConfig()\r
4720          * \r
4721          * @param       string  $name   \r
4722          * @param       string  $val    \r
4723          * @return      integer return the ID in which the latest query posted\r
4724          */\r
4725         static private function updateConfig($name, $val)\r
4726         {\r
4727                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4728                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4729                 if ( DB::execute($query) === FALSE )\r
4730                 {\r
4731                         $err = DB::getError();\r
4732                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4733                 }\r
4734                 return DB::getInsertId();\r
4735         }\r
4736         \r
4737         /**\r
4738          * Admin::error()\r
4739          * Error message\r
4740          * \r
4741          * @param       string  $msg    message that will be shown\r
4742          * @return      void\r
4743          */\r
4744         static public function error($msg)\r
4745         {\r
4746                 self::$headMess = $msg;\r
4747                 self::$skin->parse('adminerrorpage');\r
4748                 return;\r
4749         }\r
4750         \r
4751         /**\r
4752          * Admin::disallow()\r
4753          * add error log and show error page \r
4754          * \r
4755          * @param       void\r
4756          * @return      void\r
4757          */\r
4758         static public function disallow()\r
4759         {\r
4760                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4761                 self::error(_ERROR_DISALLOWED);\r
4762                 return;\r
4763         }\r
4764 \r
4765         /**\r
4766          * Admin::action_PluginAdmin()\r
4767          * Output pluginadmin\r
4768          *\r
4769          * @param       string  $skinContents\r
4770          * @param       string  $extrahead\r
4771          * @return      void\r
4772          */\r
4773         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4774         {\r
4775                 self::$extrahead .= $extrahead;\r
4776                 self::$skin->parse('pluginadmin', $skinContents);\r
4777                 return;\r
4778         }\r
4779         \r
4780         /**\r
4781          * Admin::action_bookmarklet()\r
4782          * \r
4783          * @param       void\r
4784          * @return      void\r
4785          */\r
4786         static private function action_bookmarklet()\r
4787         {\r
4788                 global $member, $manager;\r
4789                 \r
4790                 $blogid = intRequestVar('blogid');\r
4791                 $member->teamRights($blogid) or self::disallow();\r
4792                 \r
4793                 self::$skin->parse('bookmarklet');\r
4794                 return;\r
4795         }\r
4796         \r
4797         /**\r
4798          * Admin::action_actionlog()\r
4799          * \r
4800          * @param       void\r
4801          * @return      void\r
4802          */\r
4803         static private function action_actionlog()\r
4804         {\r
4805                 global $member, $manager;\r
4806                 \r
4807                 $member->isAdmin() or self::disallow();\r
4808                 \r
4809                 self::$skin->parse('actionlog');\r
4810                 return;\r
4811         }\r
4812         \r
4813         /**\r
4814          * Admin::action_banlist()\r
4815          * \r
4816          * @param       void\r
4817          * @return      void\r
4818          */\r
4819         static private function action_banlist()\r
4820         {\r
4821                 global $member, $manager;\r
4822                 \r
4823                 $blogid = intRequestVar('blogid');\r
4824                 $member->blogAdminRights($blogid) or self::disallow();\r
4825                 \r
4826                 self::$skin->parse('banlist');\r
4827                 return;\r
4828         }\r
4829         \r
4830         /**\r
4831          * Admin::action_banlistdelete()\r
4832          * \r
4833          * @param       void\r
4834          * @return      void\r
4835          */\r
4836         static private function action_banlistdelete()\r
4837         {\r
4838                 global $member, $manager;\r
4839                 \r
4840                 $blogid = intRequestVar('blogid');\r
4841                 $member->blogAdminRights($blogid) or self::disallow();\r
4842                 \r
4843                 self::$skin->parse('banlistdelete');\r
4844                 return;\r
4845         }\r
4846         \r
4847         /**\r
4848          * Admin::action_banlistdeleteconfirm()\r
4849          * \r
4850          * @param       void\r
4851          * @return      void\r
4852          */\r
4853         static private function action_banlistdeleteconfirm()\r
4854         {\r
4855                 global $member, $manager;\r
4856                 \r
4857                 $blogid         = intPostVar('blogid');\r
4858                 $allblogs       = postVar('allblogs');\r
4859                 $iprange        = postVar('iprange');\r
4860                 \r
4861                 $member->blogAdminRights($blogid) or self::disallow();\r
4862                 \r
4863                 $deleted = array();\r
4864                 \r
4865                 if ( !$allblogs )\r
4866                 {\r
4867                         if ( Ban::removeBan($blogid, $iprange) )\r
4868                         {\r
4869                                 $deleted[] = $blogid;\r
4870                         }\r
4871                 }\r
4872                 else\r
4873                 {\r
4874                         // get blogs fot which member has admin rights\r
4875                         $adminblogs = $member->getAdminBlogs();\r
4876                         foreach ($adminblogs as $blogje)\r
4877                         {\r
4878                                 if ( Ban::removeBan($blogje, $iprange) )\r
4879                                 {\r
4880                                         $deleted[] = $blogje;\r
4881                                 }\r
4882                         }\r
4883                 }\r
4884                 \r
4885                 if ( sizeof($deleted) == 0 )\r
4886                 {\r
4887                         self::error(_ERROR_DELETEBAN);\r
4888                 }\r
4889                 \r
4890                 /* TODO: we should use other ways */\r
4891                 $_REQUEST['delblogs'] = $deleted;\r
4892                 \r
4893                 self::$skin->parse('banlistdeleteconfirm');\r
4894                 return;\r
4895         }\r
4896         \r
4897         /**\r
4898          * Admin::action_banlistnewfromitem()\r
4899          * \r
4900          * @param       void\r
4901          * @return      void\r
4902          */\r
4903         static private function action_banlistnewfromitem()\r
4904         {\r
4905                 global $manager;\r
4906                 \r
4907                 $itemid = intRequestVar('itemid');\r
4908                 $item =& $manager->getItem($itemid, 1, 1);\r
4909                 self::action_banlistnew($item['blogid']);\r
4910                 return;\r
4911         }\r
4912         \r
4913         /**\r
4914          * Admin::action_banlistnew()\r
4915          * \r
4916          * @param       integer $blogid ID for weblog\r
4917          * @return      void\r
4918          */\r
4919         static private function action_banlistnew($blogid = '')\r
4920         {\r
4921                 global $member, $manager;\r
4922                 \r
4923                 if ( $blogid == '' )\r
4924                 {\r
4925                         $blogid = intRequestVar('blogid');\r
4926                 }\r
4927                 \r
4928                 $ip = requestVar('ip');\r
4929                 \r
4930                 $member->blogAdminRights($blogid) or self::disallow();\r
4931                 \r
4932                 /* TODO: we should consider to use the other way instead of this */\r
4933                 $_REQUEST['blogid'] = $blogid;          \r
4934                 \r
4935                 self::$skin->parse('banlistnew');\r
4936                 \r
4937                 return;\r
4938         }\r
4939 \r
4940         /**\r
4941          * Admin::action_banlistadd()\r
4942          * \r
4943          * @param       void\r
4944          * @return      void\r
4945          */\r
4946         static private function action_banlistadd()\r
4947         {\r
4948                 global $member;\r
4949                 \r
4950                 $blogid         = intPostVar('blogid');\r
4951                 $allblogs       = postVar('allblogs');\r
4952                 $iprange        = postVar('iprange');\r
4953                 \r
4954                 if ( $iprange == "custom" )\r
4955                 {\r
4956                         $iprange = postVar('customiprange');\r
4957                 }\r
4958                 $reason   = postVar('reason');\r
4959                 \r
4960                 $member->blogAdminRights($blogid) or self::disallow();\r
4961                 \r
4962                 // TODO: check IP range validity\r
4963                 \r
4964                 if ( !$allblogs )\r
4965                 {\r
4966                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4967                         {\r
4968                                 self::error(_ERROR_ADDBAN);\r
4969                         }\r
4970                 }\r
4971                 else\r
4972                 {\r
4973                         // get blogs fot which member has admin rights\r
4974                         $adminblogs = $member->getAdminBlogs();\r
4975                         $failed = 0;\r
4976                         foreach ($adminblogs as $blogje)\r
4977                         {\r
4978                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4979                                 {\r
4980                                         $failed = 1;\r
4981                                 }\r
4982                         }\r
4983                         if ( $failed )\r
4984                         {\r
4985                                 self::error(_ERROR_ADDBAN);\r
4986                         }\r
4987                 }\r
4988                 self::action_banlist();\r
4989                 return;\r
4990         }\r
4991         \r
4992         /**\r
4993          * Admin::action_clearactionlog()\r
4994          * \r
4995          * @param       void\r
4996          * @return      void\r
4997          */\r
4998         static private function action_clearactionlog()\r
4999         {\r
5000                 global $member;\r
5001                 \r
5002                 $member->isAdmin() or self::disallow();\r
5003                 \r
5004                 ActionLog::clear();\r
5005                 \r
5006                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5007                 return;\r
5008         }\r
5009         \r
5010         /**\r
5011          * Admin::action_backupoverview()\r
5012          * \r
5013          * @param       void\r
5014          * @return      void\r
5015          */\r
5016         static private function action_backupoverview()\r
5017         {\r
5018                 global $member, $manager;\r
5019                 \r
5020                 $member->isAdmin() or self::disallow();\r
5021                 \r
5022                 self::$skin->parse('backupoverview');\r
5023                 return;\r
5024         }\r
5025 \r
5026         /**\r
5027          * Admin::action_backupcreate()\r
5028          * create file for backup\r
5029          * \r
5030          * @param               void\r
5031          * @return      void\r
5032          * \r
5033          */\r
5034         static private function action_backupcreate()\r
5035         {\r
5036                 global $member, $DIR_LIBS;\r
5037                 \r
5038                 $member->isAdmin() or self::disallow();\r
5039                 \r
5040                 // use compression ?\r
5041                 $useGzip = (integer) postVar('gzip');\r
5042                 \r
5043                 include($DIR_LIBS . 'backup.php');\r
5044                 \r
5045                 // try to extend time limit\r
5046                 // (creating/restoring dumps might take a while)\r
5047                 @set_time_limit(1200);\r
5048                 \r
5049                 Backup::do_backup($useGzip);\r
5050                 exit;\r
5051         }\r
5052         \r
5053         /**\r
5054          * Admin::action_backuprestore()\r
5055          * restoring from uploaded file\r
5056          * \r
5057          * @param               void\r
5058          * @return      void\r
5059          */\r
5060         static private function action_backuprestore()\r
5061         {\r
5062                 global $member, $DIR_LIBS;\r
5063                 \r
5064                 $member->isAdmin() or self::disallow();\r
5065                 \r
5066                 if ( intPostVar('letsgo') != 1 )\r
5067                 {\r
5068                         self::error(_ERROR_BACKUP_NOTSURE);\r
5069                 }\r
5070                 \r
5071                 include($DIR_LIBS . 'backup.php');\r
5072                 \r
5073                 // try to extend time limit\r
5074                 // (creating/restoring dumps might take a while)\r
5075                 @set_time_limit(1200);\r
5076                 \r
5077                 $message = Backup::do_restore();\r
5078                 if ( $message != '' )\r
5079                 {\r
5080                         self::error($message);\r
5081                 }\r
5082                 self::$skin->parse('backuprestore');\r
5083                 return;\r
5084         }\r
5085         \r
5086         /**\r
5087          * Admin::action_pluginlist()\r
5088          * output the list of installed plugins\r
5089          * \r
5090          * @param       void\r
5091          * @return      void\r
5092          * \r
5093          */\r
5094         static private function action_pluginlist()\r
5095         {\r
5096                 global $DIR_PLUGINS, $member, $manager;\r
5097                 \r
5098                 // check if allowed\r
5099                 $member->isAdmin() or self::disallow();\r
5100                 \r
5101                 self::$skin->parse('pluginlist');\r
5102                 return;\r
5103         }\r
5104         \r
5105         /**\r
5106          * Admin::action_pluginhelp()\r
5107          * \r
5108          * @param       void\r
5109          * @return      void\r
5110          */\r
5111         static private function action_pluginhelp()\r
5112         {\r
5113                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5114                 \r
5115                 // check if allowed\r
5116                 $member->isAdmin() or self::disallow();\r
5117                 \r
5118                 $plugid = intGetVar('plugid');\r
5119                 \r
5120                 if ( !$manager->pidInstalled($plugid) )\r
5121                 {\r
5122                         self::error(_ERROR_NOSUCHPLUGIN);\r
5123                 }\r
5124                 \r
5125                 self::$skin->parse('pluginhelp');\r
5126                 return;\r
5127         }\r
5128         \r
5129         /**\r
5130          * Admin::action_pluginadd()\r
5131          * \r
5132          * @param       Void\r
5133          * @return      Void\r
5134          * \r
5135          */\r
5136         static private function action_pluginadd()\r
5137         {\r
5138                 global $member, $manager, $DIR_PLUGINS;\r
5139                 \r
5140                 // check if allowed\r
5141                 $member->isAdmin() or self::disallow();\r
5142                 \r
5143                 $name = postVar('filename');\r
5144                 \r
5145                 if ( $manager->pluginInstalled($name) )\r
5146                 {\r
5147                         self::error(_ERROR_DUPPLUGIN);\r
5148                 }\r
5149                 \r
5150                 if ( !checkPlugin($name) )\r
5151                 {\r
5152                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5153                 }\r
5154                 \r
5155                 // get number of currently installed plugins\r
5156                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5157                 $numCurrent = $res->rowCount();\r
5158                 \r
5159                 // plugin will be added as last one in the list\r
5160                 $newOrder = $numCurrent + 1;\r
5161                 \r
5162                 $data = array('file' => &$name);\r
5163                 $manager->notify('PreAddPlugin', $data);\r
5164                 \r
5165                 // do this before calling getPlugin (in case the plugin id is used there)\r
5166                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5167                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5168                 DB::execute($query);\r
5169                 $iPid = DB::getInsertId();\r
5170                 \r
5171                 $manager->clearCachedInfo('installedPlugins');\r
5172                 \r
5173                 // Load the plugin for condition checking and instalation\r
5174                 $plugin =& $manager->getPlugin($name);\r
5175                 \r
5176                 // check if it got loaded (could have failed)\r
5177                 if ( !$plugin )\r
5178                 {\r
5179                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5180                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5181                         \r
5182                         DB::execute($query);\r
5183                         \r
5184                         $manager->clearCachedInfo('installedPlugins');\r
5185                         self::error(_ERROR_PLUGIN_LOAD);\r
5186                 }\r
5187                 \r
5188                 // check if plugin needs a newer Nucleus version\r
5189                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5190                 {\r
5191                         // uninstall plugin again...\r
5192                         self::deleteOnePlugin($plugin->getID());\r
5193                         \r
5194                         // ...and show error\r
5195                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5196                 }\r
5197                 \r
5198                 // check if plugin needs a newer Nucleus version\r
5199                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5200                 {\r
5201                         // uninstall plugin again...\r
5202                         self::deleteOnePlugin($plugin->getID());\r
5203                         \r
5204                         // ...and show error\r
5205                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5206                 }\r
5207                 \r
5208                 $pluginList = $plugin->getPluginDep();\r
5209                 foreach ( $pluginList as $pluginName )\r
5210                 {\r
5211                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5212                         if ($res->rowCount() == 0)\r
5213                         {\r
5214                                 // uninstall plugin again...\r
5215                                 self::deleteOnePlugin($plugin->getID());\r
5216                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5217                         }\r
5218                 }\r
5219                 \r
5220                 // call the install method of the plugin\r
5221                 $plugin->install();\r
5222                 \r
5223                 $data = array('plugin' => &$plugin);\r
5224                 $manager->notify('PostAddPlugin', $data);\r
5225                 \r
5226                 // update all events\r
5227                 self::action_pluginupdate();\r
5228                 return;\r
5229         }\r
5230         \r
5231         /**\r
5232          * ADMIN:action_pluginupdate():\r
5233          * \r
5234          * @param       Void\r
5235          * @return      Void\r
5236          * \r
5237          */\r
5238         static private function action_pluginupdate()\r
5239         {\r
5240                 global $member, $manager, $CONF;\r
5241                 \r
5242                 // check if allowed\r
5243                 $member->isAdmin() or self::disallow();\r
5244                 \r
5245                 // delete everything from plugin_events\r
5246                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5247                 \r
5248                 // loop over all installed plugins\r
5249                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5250                 foreach ( $res as $row )\r
5251                 {\r
5252                         $pid  =  $row['pid'];\r
5253                         $plug =& $manager->getPlugin($row['pfile']);\r
5254                         if ( $plug )\r
5255                         {\r
5256                                 $eventList = $plug->getEventList();\r
5257                                 foreach ( $eventList as $eventName )\r
5258                                 {\r
5259                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5260                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5261                                         DB::execute($query);\r
5262                                 }\r
5263                         }\r
5264                 }\r
5265                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5266                 return;\r
5267         }\r
5268         \r
5269         /**\r
5270          * Admin::action_plugindelete()\r
5271          * \r
5272          * @param       void\r
5273          * @return      void\r
5274          */\r
5275         static private function action_plugindelete()\r
5276         {\r
5277                 global $member, $manager;\r
5278                 \r
5279                 // check if allowed\r
5280                 $member->isAdmin() or self::disallow();\r
5281                 \r
5282                 $pid = intGetVar('plugid');\r
5283                 \r
5284                 if ( !$manager->pidInstalled($pid) )\r
5285                 {\r
5286                         self::error(_ERROR_NOSUCHPLUGIN);\r
5287                 }\r
5288                 \r
5289                 self::$skin->parse('plugindelete');\r
5290                 return;\r
5291         }\r
5292 \r
5293         /**\r
5294          * Admin::action_plugindeleteconfirm()\r
5295          * \r
5296          * @param       void\r
5297          * @return      void\r
5298          */\r
5299         static private function action_plugindeleteconfirm()\r
5300         {\r
5301                 global $member, $manager, $CONF;\r
5302                 \r
5303                 // check if allowed\r
5304                 $member->isAdmin() or self::disallow();\r
5305                 \r
5306                 $pid = intPostVar('plugid');\r
5307                 \r
5308                 $error = self::deleteOnePlugin($pid, 1);\r
5309                 if ( $error )\r
5310                 {\r
5311                         self::error($error);\r
5312                 }\r
5313                 \r
5314                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5315                 return;\r
5316         }\r
5317         \r
5318         /**\r
5319          * Admin::\r
5320          * \r
5321          * @param       void\r
5322          * @return      void\r
5323          */\r
5324         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5325         {\r
5326                 global $manager;\r
5327                 \r
5328                 $pid = intval($pid);\r
5329                 \r
5330                 if ( !$manager->pidInstalled($pid) )\r
5331                 {\r
5332                         return _ERROR_NOSUCHPLUGIN;\r
5333                 }\r
5334                 \r
5335                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5336                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5337                 $name = DB::getValue($query);\r
5338                 \r
5339                 // check dependency before delete\r
5340                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5341                 foreach ( $res as $row )\r
5342                 {\r
5343                         $plug =& $manager->getPlugin($row['pfile']);\r
5344                         if ( $plug )\r
5345                         {\r
5346                                 $depList = $plug->getPluginDep();\r
5347                                 foreach ( $depList as $depName )\r
5348                                 {\r
5349                                         if ( $name == $depName )\r
5350                                         {\r
5351                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5352                                         }\r
5353                                 }\r
5354                         }\r
5355                 }\r
5356                 \r
5357                 $data = array('plugid' => $pid);\r
5358                 $manager->notify('PreDeletePlugin', $data);\r
5359                 \r
5360                 // call the unInstall method of the plugin\r
5361                 if ( $callUninstall )\r
5362                 {\r
5363                         $plugin =& $manager->getPlugin($name);\r
5364                         if ( $plugin )\r
5365                         {\r
5366                                 $plugin->unInstall();\r
5367                         }\r
5368                 }\r
5369                 \r
5370                 // delete all subscriptions\r
5371                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5372                 \r
5373                 // delete all options\r
5374                 // get OIDs from plugin_option_desc\r
5375                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5376                 $aOIDs = array();\r
5377                 foreach ( $res as $row )\r
5378                 {\r
5379                         array_push($aOIDs, $row['oid']);\r
5380                 }\r
5381                 \r
5382                 // delete from plugin_option and plugin_option_desc\r
5383                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5384                 if (count($aOIDs) > 0)\r
5385                 {\r
5386                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5387                 }\r
5388                 \r
5389                 // update order numbers\r
5390                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5391                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5392                 \r
5393                 // delete row\r
5394                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5395                 \r
5396                 $manager->clearCachedInfo('installedPlugins');\r
5397                 $data = array('plugid' => $pid);\r
5398                 $manager->notify('PostDeletePlugin', $data);\r
5399                 \r
5400                 return '';\r
5401         }\r
5402         \r
5403         /**\r
5404          * Admin::action_pluginup()\r
5405          * \r
5406          * @param       void\r
5407          * @return      void\r
5408          */\r
5409         static private function action_pluginup()\r
5410         {\r
5411                 global $member, $manager, $CONF;\r
5412                 \r
5413                 // check if allowed\r
5414                 $member->isAdmin() or self::disallow();\r
5415                 \r
5416                 $plugid = intGetVar('plugid');\r
5417                 \r
5418                 if ( !$manager->pidInstalled($plugid) )\r
5419                 {\r
5420                         self::error(_ERROR_NOSUCHPLUGIN);\r
5421                 }\r
5422                 \r
5423                 // 1. get old order number\r
5424                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5425                 \r
5426                 // 2. calculate new order number\r
5427                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5428                 \r
5429                 // 3. update plug numbers\r
5430                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5431                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5432                 \r
5433                 //self::action_pluginlist();\r
5434                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5435                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5436                 return;\r
5437         }\r
5438         \r
5439         /**\r
5440          * Admin::action_plugindown()\r
5441          * \r
5442          * @param       void\r
5443          * @return      void\r
5444          */\r
5445         static private function action_plugindown()\r
5446         {\r
5447                 global $member, $manager, $CONF;\r
5448                 \r
5449                 // check if allowed\r
5450                 $member->isAdmin() or self::disallow();\r
5451                 \r
5452                 $plugid = intGetVar('plugid');\r
5453                 if ( !$manager->pidInstalled($plugid) )\r
5454                 {\r
5455                         self::error(_ERROR_NOSUCHPLUGIN);\r
5456                 }\r
5457                 \r
5458                 // 1. get old order number\r
5459                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5460                 \r
5461                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5462                 $maxOrder = $res->rowCount();\r
5463                 \r
5464                 // 2. calculate new order number\r
5465                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5466                 \r
5467                 // 3. update plug numbers\r
5468                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5469                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5470                 \r
5471                 //self::action_pluginlist();\r
5472                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5473                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5474                 return;\r
5475         }\r
5476         \r
5477         /**\r
5478          * Admin::action_pluginoptions()\r
5479          * \r
5480          * Output Plugin option page\r
5481          * \r
5482          * @access      public\r
5483          * @param       string $message message when fallbacked\r
5484          * @return      void\r
5485          * \r
5486          */\r
5487         static private function action_pluginoptions($message = '')\r
5488         {\r
5489                 global $member, $manager;\r
5490                 \r
5491                 // check if allowed\r
5492                 $member->isAdmin() or self::disallow();\r
5493                 \r
5494                 $pid = intRequestVar('plugid');\r
5495                 if ( !$manager->pidInstalled($pid) )\r
5496                 {\r
5497                         self::error(_ERROR_NOSUCHPLUGIN);\r
5498                 }\r
5499                 \r
5500                 if ( isset($message) )\r
5501                 {\r
5502                         self::$headMess = $message;\r
5503                 }\r
5504                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5505                 $plugin         = $manager->getPlugin($plugname);\r
5506                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"<%skinfile(/javascripts/numbercheck.js)%>\"></script>\n";\r
5507                 \r
5508                 self::$skin->parse('pluginoptions');\r
5509                 return;\r
5510         }\r
5511         \r
5512         /**\r
5513          * Admin::action_pluginoptionsupdate()\r
5514          * \r
5515          * Update plugin options and fallback to plugin option page\r
5516          * \r
5517          * @access      public\r
5518          * @param       void\r
5519          * @return      void\r
5520          */\r
5521         static private function action_pluginoptionsupdate()\r
5522         {\r
5523                 global $member, $manager;\r
5524                 \r
5525                 // check if allowed\r
5526                 $member->isAdmin() or self::disallow();\r
5527                 \r
5528                 $pid = intRequestVar('plugid');\r
5529                 \r
5530                 if ( !$manager->pidInstalled($pid) )\r
5531                 {\r
5532                         self::error(_ERROR_NOSUCHPLUGIN);\r
5533                 }\r
5534                 \r
5535                 $aOptions = requestArray('plugoption');\r
5536                 NucleusPlugin::apply_plugin_options($aOptions);\r
5537                 \r
5538                 $data = array(\r
5539                         'context'       => 'global',\r
5540                         'plugid'        => $pid\r
5541                 );\r
5542                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5543                 \r
5544                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5545                 return;\r
5546         }\r
5547         \r
5548         /**\r
5549          * Admin::action_parseSpecialskin()\r
5550          * \r
5551          * @param       void\r
5552          * @return      void\r
5553          */\r
5554         static private function action_parseSpecialskin()\r
5555         {\r
5556                 self::$skin->parse(self::$action);\r
5557                 return;\r
5558         }\r
5559         \r
5560         /**\r
5561          * Admin::getAdminskinIDFromName()\r
5562          * \r
5563          * @param       string  $skinname       name of skin\r
5564          * @return      integer ID for skin\r
5565          */\r
5566         static private function getAdminskinIDFromName($skinname)\r
5567         {\r
5568                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5569                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5570                 $admnSknID      = DB::getValue($query);\r
5571                 return (integer) $adminSkinID;\r
5572         }\r
5573         \r
5574         /**\r
5575          * Admin::getAdminskinNameFromID()\r
5576          * \r
5577          * @param       integer $skinid ID for skin\r
5578          * @return      integer ID for skin\r
5579          */\r
5580         static private function getAdminskinNameFromID($skinid)\r
5581         {\r
5582                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5583                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5584                 $admnSknID      = DB::getValue($query);\r
5585                 return (integer) $adminSkinID;\r
5586         }\r
5587         \r
5588         /**\r
5589          * Admin::getAdminextrahead()\r
5590          */\r
5591         static public function getAdminextrahead()\r
5592         {\r
5593                 return self::$extrahead;\r
5594         }\r
5595         \r
5596         /**\r
5597          * Admin::getAdminpassvar()\r
5598          */\r
5599         static public function getAdminpassvar()\r
5600         {\r
5601                 return self::$passvar;\r
5602         }\r
5603         \r
5604         /**\r
5605          * Admin::getAdminAction()\r
5606          */\r
5607         static public function getAdminAction()\r
5608         {\r
5609                 return self::$action;\r
5610         }\r
5611         \r
5612         /**\r
5613          * Admin::getAdminaOption()\r
5614          */\r
5615         static public function getAdminaOption()\r
5616         {\r
5617                 return self::$aOptions;\r
5618         }\r
5619         \r
5620         /**\r
5621          * Admin::action_importAdmin()\r
5622          * \r
5623          * @param       void\r
5624          * @return      void\r
5625          */\r
5626         static private function action_importAdmin()\r
5627         {\r
5628                 global $DIR_ADMINSKINS, $action;\r
5629                 if ( $action == 'adminskinieimport' )\r
5630                 {\r
5631                         self::doAdminskinimport();\r
5632                 }\r
5633                 $skn = array();\r
5634                 if ( $action == 'showlogin' )\r
5635                 {\r
5636                         $skinName = 'showlogin';\r
5637                         $actnName = 'showlogin';\r
5638                 }\r
5639                 else\r
5640                 {\r
5641                         $skinName = 'defaultimporter';\r
5642                         $actnName = 'importAdmin';\r
5643                 }\r
5644                 \r
5645                 /* TODO: why??? */\r
5646                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5647                 $skn['id']                              = 0;\r
5648                 $skn['description']             = $skinName;\r
5649                 $skn['contentType']             = 'importAdmin';\r
5650                 $skn['includeMode']             = 'normal';\r
5651                 $skn['includePrefix']   = '';\r
5652                 $skn['name']                    = 'defaultinporter';\r
5653                 \r
5654                 self::$skin                             = (object) $skn;\r
5655                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5656                 \r
5657                 $parser = new PARSER($handler);\r
5658                 $parser->setSkin(self::$skin);\r
5659                 $parser->parse($contents);\r
5660                 \r
5661                 return;\r
5662         }\r
5663         \r
5664         /**\r
5665          * Admin::doAdminskinimport()\r
5666          * \r
5667          * @param       void\r
5668          * @return      void\r
5669          */\r
5670         static private function doAdminskinimport()\r
5671         {\r
5672                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5673                 \r
5674                 $member->isAdmin() or self::disallow();\r
5675                 \r
5676                 include_once($DIR_LIBS . 'Skinie.php');\r
5677                 $skinFileRaw    = postVar('skinfile');\r
5678                 $mode                   = postVar('mode');\r
5679                 $allowOverwrite = intPostVar('overwrite');\r
5680                 \r
5681                 if ( $mode == 'file' )\r
5682                 {\r
5683                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5684                 }\r
5685                 else\r
5686                 {\r
5687                         $skinFile = $skinFileRaw;\r
5688                 }\r
5689                 \r
5690                 $importer       = new SKINIMPORT();\r
5691                 $error          = $importer->readFile($skinFile);\r
5692                 if ( $error )\r
5693                 {\r
5694                         self::error($error);\r
5695                 }\r
5696                 $error = $importer->writeToDatabase($allowOverwrite);\r
5697                 if ( $error )\r
5698                 {\r
5699                         self::error($error);\r
5700                 }\r
5701                 \r
5702                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5703                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5704                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5705                 \r
5706                 header('Location: ' . $CONF['AdminURL']);\r
5707                 exit;\r
5708         }\r
5709 }\r