nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static private $action;\r
  31         static private $skin;\r
  32         static private $extrahead;\r
  33         static private $passvar;\r
  34         static private $headMess;\r
  35         static private $aOptions;\r
  36         \r
  37         /**\r
  38          * Admin::$edit_actions\r
  39          */\r
  40         static private $edit_actions = array(\r
  41                 'adminskinoverview',\r
  42                 'adminskinieoverview',\r
  43                 'adminskinedittype',\r
  44                 'adminskinremovetype',\r
  45                 'adminskindelete',\r
  46                 'adminskinedit',\r
  47                 'adminskinieimport',\r
  48                 'adminskiniedoimport',\r
  49                 'admintemplateedit',\r
  50                 'admintemplateoverview',\r
  51                 'admintemplatedelete'\r
  52         );\r
  53         \r
  54         /**\r
  55          * Admin::$skinless_actions\r
  56          */\r
  57         static private $skinless_actions = array(\r
  58                 'plugindeleteconfirm',\r
  59                 'pluginoptionsupdate',\r
  60                 'skinremovetypeconfirm',\r
  61                 'skinclone',\r
  62                 'skindeleteconfirm',\r
  63                 'skinnew',\r
  64                 'skineditgeneral',\r
  65                 'skinieexport',\r
  66                 'skinupdate',\r
  67                 'templateupdate',\r
  68                 'templatedeleteconfirm',\r
  69                 'templatenew',\r
  70                 'templateclone',\r
  71                 'adminskinremovetypeconfirm',\r
  72                 'adminskinclone',\r
  73                 'adminskindeleteconfirm',\r
  74                 'adminskinnew',\r
  75                 'adminskineditgeneral',\r
  76                 'adminskinieexport',\r
  77                 'adminskinupdate',\r
  78                 'admintemplateupdate',\r
  79                 'admintemplatedeleteconfirm',\r
  80                 'admintemplatenew',\r
  81                 'admintemplateclone',\r
  82                 'blogsettingsupdate',\r
  83                 'settingsupdate',\r
  84                 'addnewlog2',\r
  85                 'additem',\r
  86                 'itemdeleteconfirm',\r
  87                 'itemupdate',\r
  88                 'changemembersettings',\r
  89                 'clearactionlog',\r
  90                 'memberedit'\r
  91         );\r
  92         \r
  93         static private $actions_needless_to_check = array(\r
  94                 'showlogin',\r
  95                 'login',\r
  96                 'overview',\r
  97                 'itemlist',\r
  98                 'blogcommentlist',\r
  99                 'bookmarklet',\r
 100                 'blogsettings',\r
 101                 'banlist',\r
 102                 'deleteblog',\r
 103                 'editmembersettings',\r
 104                 'browseownitems',\r
 105                 'browseowncomments',\r
 106                 'createitem',\r
 107                 'itemedit',\r
 108                 'itemmove',\r
 109                 'categoryedit',\r
 110                 'categorydelete',\r
 111                 'manage',\r
 112                 'actionlog',\r
 113                 'settingsedit',\r
 114                 'backupoverview',\r
 115                 'pluginlist',\r
 116                 'createnewlog',\r
 117                 'usermanagement',\r
 118                 'skinoverview',\r
 119                 'templateoverview',\r
 120                 'skinieoverview',\r
 121                 'itemcommentlist',\r
 122                 'commentedit',\r
 123                 'commentdelete',\r
 124                 'banlistnewfromitem',\r
 125                 'banlistdelete',\r
 126                 'itemdelete',\r
 127                 'manageteam',\r
 128                 'teamdelete',\r
 129                 'banlistnew',\r
 130                 'memberedit',\r
 131                 'memberdelete',\r
 132                 'pluginhelp',\r
 133                 'pluginoptions',\r
 134                 'plugindelete',\r
 135                 'skinedittype',\r
 136                 'skinremovetype',\r
 137                 'skindelete',\r
 138                 'skinedit',\r
 139                 'templateedit',\r
 140                 'templatedelete',\r
 141                 'activate',\r
 142                 'systemoverview',\r
 143                 'activatesetpwd',\r
 144         );\r
 145         \r
 146         static public function initialize()\r
 147         {\r
 148                 global $CONF, $DIR_LIBS;\r
 149                 \r
 150                 /* NOTE: 1. decide which skinid to use */\r
 151                 $skinid = $CONF['DefaultAdminSkin'];\r
 152                 /*\r
 153                  * NOTE: this is temporary escaped because not implemented yet\r
 154                 if (isset($member) && $member->isLoggedIn())\r
 155                 {\r
 156                         $memskin = $member->getAdminSkin();\r
 157                         if ( $memskin )\r
 158                         {\r
 159                                 $skinid = $memskin;\r
 160                         }\r
 161                 }\r
 162                 */\r
 163                 \r
 164                 /* NOTE: 2. make an instance of skin object */\r
 165                 if ( !Skin::existsID($skinid) )\r
 166                 {\r
 167                         return FALSE;\r
 168                 }\r
 169                 \r
 170                 /* NOTE: 3. initializing each members */\r
 171                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 172                 self::$action           = '';\r
 173                 self::$extrahead        = '';\r
 174                 self::$passvar          = '';\r
 175                 self::$headMess         = '';\r
 176                 self::$aOptions         = '';\r
 177                 return TRUE;\r
 178         }\r
 179         \r
 180         /**\r
 181          * Admin::action()\r
 182          * Executes an action\r
 183          *\r
 184          * @param       string  $action action to be performed\r
 185          * @return      void\r
 186          */\r
 187         static public function action($action)\r
 188         {\r
 189                 global $CONF, $DIR_LIBS, $manager, $member;\r
 190                 \r
 191                 /* 1. decide action name */\r
 192                 $customAction = postvar('customaction');\r
 193                 if ( !empty($customAction) )\r
 194                 {\r
 195                         $alias = array(\r
 196                                 'login' => $customAction,\r
 197                                 ''              => $customAction\r
 198                         );\r
 199                 }\r
 200                 else\r
 201                 {\r
 202                         $alias = array(\r
 203                                 'login' => 'overview',\r
 204                                 ''              => 'overview'\r
 205                         );\r
 206                 }\r
 207                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 208                 {\r
 209                         $action = $alias[$action];\r
 210                 }\r
 211                 $methodName = "action_{$action}";\r
 212                 self::$action = strtolower($action);\r
 213                 \r
 214                 /* 2. check the action */\r
 215                 $synonimActions = array(\r
 216                         'banlistnewfromitem',\r
 217                         'memberedit',\r
 218                         'login',\r
 219                 );\r
 220                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 221                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 222                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 223                 {\r
 224                         if (!$manager->checkTicket())\r
 225                         {\r
 226                                 self::error(_ERROR_BADTICKET);\r
 227                         }\r
 228                 }\r
 229 \r
 230                 /* 3. parse according to the action */\r
 231                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 232                 {\r
 233                         /* TODO: what is this?\r
 234                         self::action_parseSpecialskin();\r
 235                         */\r
 236                 }\r
 237                 elseif ( method_exists('Admin', $methodName) )\r
 238                 {\r
 239                         call_user_func(array(self, $methodName));\r
 240                 }\r
 241                 else if ( self::existsSkinContents('adminerrorpage') )\r
 242                 {\r
 243                         self::error(_BADACTION . ENTITY::hsc($action));\r
 244                 }\r
 245                 elseif ( $id != $CONF['DefaultAdminSkin'] )\r
 246                 {\r
 247                         self::$skin = new Skin($CONF['DefaultAdminSkin']);\r
 248                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 249                         {\r
 250                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 251                         }\r
 252                 }\r
 253                 else\r
 254                 {\r
 255                         self::error(_BADACTION . ENTITY::hsc($action));\r
 256                 }\r
 257                 exit;\r
 258         }\r
 259         \r
 260         /**\r
 261          * Action::existsSkinContents()\r
 262          * Check skin contents\r
 263          *\r
 264          * @param       string  $action action type\r
 265          * @return      boolean\r
 266          */\r
 267         static private function existsSkinContents($action)\r
 268         {\r
 269                 $in_array  = in_array($action, self::$skinless_actions);\r
 270                 \r
 271                 if ( $in_array )\r
 272                 {\r
 273                         return $in_array;\r
 274                 }\r
 275                 else\r
 276                 {\r
 277                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype='%s';";\r
 278                         /* TODO: skinid should be a default */\r
 279                         if ( !is_object(self::$skin) )\r
 280                         {\r
 281                                 global $CONF;\r
 282                                 return quickQuery(sprintf($query, sql_table('skin'), $CONF['DefaultAdminSkin'], sql_real_escape_string($action)));\r
 283                         }\r
 284                         else\r
 285                         {\r
 286                                 return quickQuery(sprintf($query, sql_table('skin'), self::$skin->getID(), sql_real_escape_string($action)));\r
 287                         }\r
 288                 }\r
 289                 return;\r
 290         }\r
 291         \r
 292         /**\r
 293          * Action::specialActionsAllow()\r
 294          * Check exists specialskinparts\r
 295          *\r
 296          * @param       string  $action action type\r
 297          * @return boolean\r
 298          */\r
 299         static private function specialActionsAllow($action)\r
 300         {\r
 301                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = '%s';";\r
 302                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, sql_real_escape_string($action));\r
 303                 return quickQuery($query);\r
 304         }\r
 305         \r
 306         /**\r
 307          * Action::action_showlogin()\r
 308          * \r
 309          * @param       void\r
 310          * @return      void\r
 311          */\r
 312         static private function action_showlogin()\r
 313         {\r
 314                 global $error;\r
 315                 self::action_login($error);\r
 316                 return;\r
 317         }\r
 318         \r
 319         /**\r
 320          * Action::action_login()\r
 321          * \r
 322          * @param       string  $msg            message for pageheader\r
 323          * @param       integer $passvars       ???\r
 324          */\r
 325         static private function action_login($msg = '', $passvars = 1)\r
 326         {\r
 327                 global $member;\r
 328                 \r
 329                 // skip to overview when allowed\r
 330                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 331                 {\r
 332                         self::$action_overview();\r
 333                         exit;\r
 334                 }\r
 335                 \r
 336                 /* TODO: needless variable??? */\r
 337                 self::$passvar = $passvars;\r
 338                 if ( $msg )\r
 339                 {\r
 340                         self::$headMess = $msg;\r
 341                 }\r
 342                 \r
 343                 self::pagehead();\r
 344                 self::$skin->parse('showlogin');\r
 345                 self::pagefoot();\r
 346         }\r
 347         \r
 348         /**\r
 349          * Action::action_overview()\r
 350          * provides a screen with the overview of the actions available\r
 351          * \r
 352          * @param       string  $msg    message for pageheader\r
 353          * @return      void\r
 354          */\r
 355         static private function action_overview($msg = '')\r
 356         {\r
 357                 if ( $msg )\r
 358                 {\r
 359                         self::$headMess = $msg;\r
 360                 }\r
 361                 \r
 362                 self::pagehead();\r
 363                 self::$skin->parse('overview');\r
 364                 self::pagefoot();\r
 365                 return;\r
 366         }\r
 367         \r
 368         /**\r
 369          * Admin::action_manage()\r
 370          * \r
 371          * @param       string  $msg    message for pageheader\r
 372          * @retrn       void\r
 373          */\r
 374         static private function action_manage($msg = '')\r
 375         {\r
 376                 global $member;\r
 377                 \r
 378                 if ( $msg )\r
 379                 {\r
 380                         self::$headMess = $msg;\r
 381                 }\r
 382                 $member->isAdmin() or self::disallow();\r
 383                 \r
 384                 self::pagehead();\r
 385                 self::$skin->parse('manage');\r
 386                 self::pagefoot();\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::pagehead();\r
 408                 self::$skin->parse('itemlist');\r
 409                 self::pagefoot();\r
 410                 return;\r
 411         }\r
 412         \r
 413         /**\r
 414          * Action::action_batchitem()\r
 415          * \r
 416          * @param       void\r
 417          * @return      void\r
 418          */\r
 419         static private function action_batchitem()\r
 420         {\r
 421                 global $member, $manager;\r
 422                 \r
 423                 $member->isLoggedIn() or self::disallow();\r
 424                 \r
 425                 $selected       = requestIntArray('batch');\r
 426                 $action         = requestVar('batchaction');\r
 427                 \r
 428                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 429                 {\r
 430                         self::error(_BATCH_NOSELECTION);\r
 431                 }\r
 432                 \r
 433                 // On move: when no destination blog/category chosen, show choice now\r
 434                 $destCatid = intRequestVar('destcatid');\r
 435                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 436                 {\r
 437                         self::batchMoveSelectDestination('item', $selected);\r
 438                 }\r
 439                 \r
 440                 // On delete: check if confirmation has been given\r
 441                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 442                 {\r
 443                         self::batchAskDeleteConfirmation('item', $selected);\r
 444                 }\r
 445                 \r
 446                 self::pagehead();\r
 447                 self::$skin->parse('batchitem');\r
 448                 self::pagefoot();\r
 449                 return;\r
 450         }\r
 451         \r
 452         /**\r
 453          * Action::action_batchcomment()\r
 454          * \r
 455          * @param       void\r
 456          * @return      void\r
 457          */\r
 458         static private function action_batchcomment()\r
 459         {\r
 460                 global $member;\r
 461                 \r
 462                 $member->isLoggedIn() or self::disallow();\r
 463                 \r
 464                 $selected       = requestIntArray('batch');\r
 465                 $action         = requestVar('batchaction');\r
 466                 \r
 467                 // Show error when no items were selected\r
 468                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 469                 {\r
 470                         self::error(_BATCH_NOSELECTION);\r
 471                 }\r
 472                 \r
 473                 // On delete: check if confirmation has been given\r
 474                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 475                 {\r
 476                         self::batchAskDeleteConfirmation('comment',$selected);\r
 477                 }\r
 478                 \r
 479                 self::pagehead();\r
 480                 self::$skin->parse('batchcomment');\r
 481                 self::pagefoot();\r
 482                 return;\r
 483         }\r
 484         \r
 485         /**\r
 486          * Admin::action_batchmember()\r
 487          * \r
 488          * @param       void\r
 489          * @return      void\r
 490          */\r
 491         static private function action_batchmember()\r
 492         {\r
 493                 global $member;\r
 494                 \r
 495                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 496                 \r
 497                 $selected       = requestIntArray('batch');\r
 498                 $action         = requestVar('batchaction');\r
 499                 \r
 500                 // Show error when no members selected\r
 501                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 502                 {\r
 503                         self::error(_BATCH_NOSELECTION);\r
 504                 }\r
 505                 \r
 506                 // On delete: check if confirmation has been given\r
 507                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 508                 {\r
 509                         self::batchAskDeleteConfirmation('member',$selected);\r
 510                 }\r
 511                 \r
 512                 self::pagehead();\r
 513                 self::$skin->parse('batchmember');\r
 514                 self::pagefoot();\r
 515                 return;\r
 516         }\r
 517         \r
 518         /**\r
 519          * Admin::action_batchteam()\r
 520          * \r
 521          * @param       void\r
 522          * @return      void\r
 523          */\r
 524         static private function action_batchteam()\r
 525         {\r
 526                 global $member;\r
 527                 \r
 528                 $blogid = intRequestVar('blogid');\r
 529                 \r
 530                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 531                 \r
 532                 $selected       = requestIntArray('batch');\r
 533                 $action         = requestVar('batchaction');\r
 534                 \r
 535                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 536                 {\r
 537                         self::error(_BATCH_NOSELECTION);\r
 538                 }\r
 539                 \r
 540                 // On delete: check if confirmation has been given\r
 541                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 542                 {\r
 543                         self::batchAskDeleteConfirmation('team',$selected);\r
 544                 }\r
 545                 \r
 546                 self::pagehead();\r
 547                 self::$skin->parse('batchteam');\r
 548                 self::pagefoot();\r
 549                 return;\r
 550         }\r
 551         \r
 552         /**\r
 553          * Admin::action_batchcategory()\r
 554          * \r
 555          * @param       void\r
 556          * @return      void\r
 557          */\r
 558         static private function action_batchcategory()\r
 559         {\r
 560                 global $member, $manager;\r
 561                 \r
 562                 $member->isLoggedIn() or self::disallow();\r
 563                 \r
 564                 $selected       = requestIntArray('batch');\r
 565                 $action         = requestVar('batchaction');\r
 566                 \r
 567                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 568                 {\r
 569                         self::error(_BATCH_NOSELECTION);\r
 570                 }\r
 571                 \r
 572                 // On move: when no destination blog chosen, show choice now\r
 573                 $destBlogId = intRequestVar('destblogid');\r
 574                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 575                 {\r
 576                         self::batchMoveCategorySelectDestination('category', $selected);\r
 577                 }\r
 578                 \r
 579                 // On delete: check if confirmation has been given\r
 580                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 581                 {\r
 582                         self::batchAskDeleteConfirmation('category', $selected);\r
 583                 }\r
 584                 \r
 585                 self::pagehead();\r
 586                 self::$skin->parse('batchcategory');\r
 587                 self::pagefoot();\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::pagehead();\r
 604                 self::$skin->parse('batchmove');\r
 605                 self::pagefoot();\r
 606                 return;\r
 607         }\r
 608         \r
 609         /**\r
 610          * Admin::batchMoveCategorySelectDestination()\r
 611          * \r
 612          * @param       string  $type   type of batch action\r
 613          * @param       integer $ids    needless???\r
 614          * @return      void\r
 615          * \r
 616          * TODO: remove needless argument\r
 617          */\r
 618         static private function batchMoveCategorySelectDestination($type, $ids)\r
 619         {\r
 620                 $_POST['batchmove'] = $type;\r
 621                 global $manager;\r
 622                 self::pagehead();\r
 623                 self::$skin->parse('batchmovecat');\r
 624                 self::pagefoot();\r
 625                 return;\r
 626         }\r
 627         \r
 628         /**\r
 629          * Admin::batchAskDeleteConfirmation()\r
 630          * \r
 631          * @param       string  $type   type of batch action\r
 632          * @param       integer $ids    needless???\r
 633          * @return      void\r
 634          * \r
 635          * TODO: remove needless argument\r
 636          */\r
 637         static private function batchAskDeleteConfirmation($type, $ids)\r
 638         {\r
 639                 self::pagehead();\r
 640                 self::$skin->parse('batchdelete');\r
 641                 self::pagefoot();\r
 642                 return;\r
 643         }\r
 644         \r
 645         /**\r
 646          * Admin::selectBlogCategory()\r
 647          * Inserts a HTML select element with choices for all categories to which the current\r
 648          * member has access\r
 649          *\r
 650          * @see function selectBlog\r
 651          * @param       string  $name                           name of weblod\r
 652          * @param       integer $selected                       \r
 653          * @param       integer $tabindex                       \r
 654          * @param       integer $showNewCat                     \r
 655          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 656          * @return      void\r
 657          *\r
 658          * NOTE: callback from AdminAction\r
 659          */\r
 660         static private function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 661         {\r
 662                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 663                 return;\r
 664         }\r
 665         \r
 666         /**\r
 667          * Admin::selectBlog()\r
 668          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 669          *      mode = 'blog' => shows blognames and values are blogids\r
 670          *      mode = 'category' => show category names and values are catids\r
 671          *\r
 672          * @param       string  $name                           name of weblod\r
 673          * @param       string  $mode                           \r
 674          * @param       integer $selected                       \r
 675          * @param       integer $tabindex                       \r
 676          * @param       integer $showNewCat                     \r
 677          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 678          * @param $iForcedBlogInclude\r
 679          *      ID of a blog that always needs to be included, without checking if the\r
 680          *      member is on the blog team (-1 = none)\r
 681          * @return      void\r
 682          */\r
 683         static private function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 684         {\r
 685                 global $member, $CONF;\r
 686                 \r
 687                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 688                 $aBlogIds = array();\r
 689                 if ( $iForcedBlogInclude != -1 )\r
 690                 {\r
 691                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 692                 }\r
 693                 \r
 694                 if ( ($member->isAdmin()) && ($CONF['ShowAllBlogs']) )\r
 695                 {\r
 696                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 697                         $query = sprintf($query, sql_table('blog'));\r
 698                 }\r
 699                 else\r
 700                 {\r
 701                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 702                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 703                 }\r
 704                 \r
 705                 $rblogids = sql_query($query);\r
 706                 while ($o = sql_fetch_object($rblogids))\r
 707                 {\r
 708                         if ( $o->bnumber != $iForcedBlogInclude )\r
 709                         {\r
 710                                 $aBlogIds[] = intval($o->bnumber);\r
 711                         }\r
 712                 }\r
 713                 \r
 714                 if ( count($aBlogIds) == 0 )\r
 715                 {\r
 716                         return;\r
 717                 }\r
 718                 \r
 719                 /* TODO: we should consider to use the other way instead of this */\r
 720                 $_REQUEST['selectData'] = array(\r
 721                         'name'                  => $name,\r
 722                         'tabindex'              => $tabindex,\r
 723                         'mode'                  => $mode,\r
 724                         'selected'              => $selected,\r
 725                         'showNewCat'    => $showNewCat,\r
 726                         'aBlogIds'              => $aBlogIds,\r
 727                 );\r
 728                 self::$skin->parse('blogselectbox');\r
 729                 return;\r
 730         }\r
 731         \r
 732         /**\r
 733          * Admin::action_browseownitems()\r
 734          * \r
 735          * @param       void\r
 736          * @return      void\r
 737          */\r
 738         static private function action_browseownitems()\r
 739         {\r
 740                 global $member, $manager, $CONF;\r
 741                 \r
 742                 self::pagehead();\r
 743                 self::$skin->parse('browseownitems');\r
 744                 self::pagefoot();\r
 745                 return;\r
 746         }\r
 747         \r
 748         /**\r
 749          * Admin::action_itemcommentlist()\r
 750          * Show all the comments for a given item\r
 751          * \r
 752          * @param       integer $itemid ID for item\r
 753          * @return      void\r
 754          */\r
 755         static private function action_itemcommentlist($itemid = '')\r
 756         {\r
 757                 global $member, $manager, $CONF;\r
 758                 \r
 759                 if ( $itemid == '' )\r
 760                 {\r
 761                         $itemid = intRequestVar('itemid');\r
 762                 }\r
 763                 \r
 764                 /* TODO: we consider to use the other way insterad of this */\r
 765                 $_REQUEST['itemid'] = $itemid;\r
 766                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 767                 \r
 768                 // only allow if user is allowed to alter item\r
 769                 $member->canAlterItem($itemid) or self::disallow();\r
 770                 \r
 771                 $blogid = getBlogIdFromItemId($itemid);\r
 772                 \r
 773                 self::pagehead();\r
 774                 self::$skin->parse('itemcommentlist');\r
 775                 self::pagefoot();\r
 776                 return;\r
 777         }\r
 778         \r
 779         /**\r
 780          * Admin::action_browseowncomments()\r
 781          * Browse own comments\r
 782          * \r
 783          * @param       void\r
 784          * @return      void\r
 785          */\r
 786         static private function action_browseowncomments()\r
 787         {\r
 788                 self::pagehead();\r
 789                 self::$skin->parse('browseowncomments');\r
 790                 self::pagefoot();\r
 791                 return;\r
 792         }\r
 793         \r
 794         /**\r
 795          * Admin::action_blogcommentlist()\r
 796          * Browse all comments for a weblog\r
 797          * \r
 798          * @param       integer $blogid ID for weblog\r
 799          * @return      void\r
 800          */\r
 801         static private function action_blogcommentlist($blogid = '')\r
 802         {\r
 803                 global $member, $manager, $CONF;\r
 804                 \r
 805                 if ( $blogid == '' )\r
 806                 {\r
 807                         $blogid = intRequestVar('blogid');\r
 808                 }\r
 809                 else\r
 810                 {\r
 811                         $blogid = intval($blogid);\r
 812                 }\r
 813                 \r
 814                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 815                 \r
 816                 /* TODO: we consider to use the other way insterad of this */\r
 817                 $_REQUEST['blogid'] = $blogid;\r
 818                 \r
 819                 self::pagehead();\r
 820                 self::$skin->parse('blogcommentlist');\r
 821                 self::pagefoot();\r
 822                 return;\r
 823         }\r
 824         \r
 825         /**\r
 826          * Admin::action_createitem()\r
 827          * Provide a page to item a new item to the given blog\r
 828          * \r
 829          * @param       void\r
 830          * @return      void\r
 831          */\r
 832         static private function action_createitem()\r
 833         {\r
 834                 global $member, $manager;\r
 835                 \r
 836                 $blogid = intRequestVar('blogid');\r
 837                 \r
 838                 // check if allowed\r
 839                 $member->teamRights($blogid) or self::disallow();\r
 840                 \r
 841                 $memberid = $member->getID();\r
 842                 \r
 843                 $blog =& $manager->getBlog($blogid);\r
 844                 \r
 845                 self::pagehead();\r
 846                 self::$skin->parse('createitem');\r
 847                 self::pagefoot();\r
 848                 return;\r
 849         }\r
 850         \r
 851         /**\r
 852          * Admin::action_itemedit()\r
 853          * \r
 854          * @param       void\r
 855          * @return      void\r
 856          */\r
 857         static private function action_itemedit()\r
 858         {\r
 859                 global $member, $manager;\r
 860                 \r
 861                 $itemid = intRequestVar('itemid');\r
 862                 \r
 863                 // only allow if user is allowed to alter item\r
 864                 $member->canAlterItem($itemid) or self::disallow();\r
 865                 \r
 866                 $item =& $manager->getItem($itemid, 1, 1);\r
 867                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));\r
 868                 \r
 869                 self::pagehead();\r
 870                 self::$skin->parse('itemedit');\r
 871                 self::pagefoot();\r
 872                 return;\r
 873         }\r
 874         \r
 875         /**\r
 876          * Admin::action_itemupdate()\r
 877          * \r
 878          * @param       void\r
 879          * @return      void\r
 880          */\r
 881         static private function action_itemupdate()\r
 882         {\r
 883                 global $member, $manager, $CONF;\r
 884                 \r
 885                 $itemid = intRequestVar('itemid');\r
 886                 $catid  = postVar('catid');\r
 887                 \r
 888                 // only allow if user is allowed to alter item\r
 889                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 890                 \r
 891                 $actiontype = postVar('actiontype');\r
 892                 \r
 893                 // delete actions are handled by itemdelete (which has confirmation)\r
 894                 if ( $actiontype == 'delete' )\r
 895                 {\r
 896                         self::$action_itemdelete();\r
 897                         return;\r
 898                 }\r
 899                 \r
 900                 $body           = postVar('body');\r
 901                 $title          = postVar('title');\r
 902                 $more           = postVar('more');\r
 903                 $closed         = intPostVar('closed');\r
 904                 $draftid        = intPostVar('draftid');\r
 905                 \r
 906                 // default action = add now\r
 907                 if ( !$actiontype )\r
 908                 {\r
 909                         $actiontype='addnow';\r
 910                 }\r
 911                 \r
 912                 // create new category if needed\r
 913                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 914                 {\r
 915                         // get blogid\r
 916                         list($blogid) = sscanf($catid,"newcat-%d");\r
 917                         \r
 918                         // create\r
 919                         $blog =& $manager->getBlog($blogid);\r
 920                         $catid = $blog->createNewCategory();\r
 921                         \r
 922                         // show error when sth goes wrong\r
 923                         if ( !$catid )\r
 924                         {\r
 925                                 self::doError(_ERROR_CATCREATEFAIL);\r
 926                         }\r
 927                 }\r
 928                 \r
 929                 /*\r
 930                         set some variables based on actiontype\r
 931 \r
 932                         actiontypes:\r
 933                                 draft items -> addnow, addfuture, adddraft, delete\r
 934                                 non-draft items -> edit, changedate, delete\r
 935 \r
 936                         variables set:\r
 937                                 $timestamp: set to a nonzero value for future dates or date changes\r
 938                                 $wasdraft: set to 1 when the item used to be a draft item\r
 939                                 $publish: set to 1 when the edited item is not a draft\r
 940          */\r
 941                 $blogid =  getBlogIDFromItemID($itemid);\r
 942                 $blog   =& $manager->getBlog($blogid);\r
 943                 \r
 944                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 945                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 946                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 947                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 948                 {\r
 949                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 950                 }\r
 951                 else\r
 952                 {\r
 953                         $timestamp =0;\r
 954                 }\r
 955                 \r
 956                 // edit the item for real\r
 957                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 958                 \r
 959                 self::updateFuturePosted($blogid);\r
 960                 \r
 961                 if ( $draftid > 0 )\r
 962                 {\r
 963                         // delete permission is checked inside Item::delete()\r
 964                         Item::delete($draftid);\r
 965                 }\r
 966                 \r
 967                 if ( $catid != intPostVar('catid') )\r
 968                 {\r
 969                         self::$action_categoryedit(\r
 970                                 $catid,\r
 971                                 $blog->getID(),\r
 972                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 973                         );\r
 974                 }\r
 975                 else\r
 976                 {\r
 977                         // TODO: set start item correctly for itemlist\r
 978                         $item = Item::getItem($itemid, 0, 0);\r
 979                         $cnt  = quickQuery('SELECT COUNT(*) FROM ' . sql_table('item') . ' WHERE unix_timestamp(itime) <= ' . $item['timestamp']);\r
 980                         $_REQUEST['start'] = $cnt + 1;\r
 981                         self::$action_itemlist(getBlogIDFromItemID($itemid));\r
 982                 }\r
 983                 return;\r
 984         }\r
 985         \r
 986         /**\r
 987          * Admin::action_itemdelete()\r
 988          * Delete item\r
 989          * \r
 990          * @param       Void\r
 991          * @return      Void\r
 992          */\r
 993         static private function action_itemdelete()\r
 994         {\r
 995                 global $member, $manager;\r
 996                 \r
 997                 $itemid = intRequestVar('itemid');\r
 998                 \r
 999                 // only allow if user is allowed to alter item\r
1000                 $member->canAlterItem($itemid) or self::disallow();\r
1001                 \r
1002                 if ( !$manager->existsItem($itemid,1,1) )\r
1003                 {\r
1004                         self::error(_ERROR_NOSUCHITEM);\r
1005                 }\r
1006                 \r
1007                 self::pagehead();\r
1008                 self::$skin->parse('itemdelete');\r
1009                 self::pagefoot();\r
1010                 return;\r
1011         }\r
1012         \r
1013         /**\r
1014          * Admin::action_itemdeleteconfirm()\r
1015          * \r
1016          * @param       void\r
1017          * @return      void\r
1018          */\r
1019         static private function action_itemdeleteconfirm()\r
1020         {\r
1021                 global $member;\r
1022                 \r
1023                 $itemid = intRequestVar('itemid');\r
1024                 \r
1025                 // only allow if user is allowed to alter item\r
1026                 $member->canAlterItem($itemid) or self::disallow();\r
1027                 \r
1028                 // get blogid first\r
1029                 $blogid = getBlogIdFromItemId($itemid);\r
1030                 \r
1031                 // delete item (note: some checks will be performed twice)\r
1032                 self::deleteOneItem($itemid);\r
1033                 \r
1034                 self::$action_itemlist($blogid);\r
1035                 return;\r
1036         }\r
1037         \r
1038         /**\r
1039          * Admin::deleteOneItem()\r
1040          * Deletes one item and returns error if something goes wrong\r
1041          * \r
1042          * @param       integer $itemid ID for item\r
1043          * @return      void\r
1044          */\r
1045         static private function deleteOneItem($itemid)\r
1046         {\r
1047                 global $member, $manager;\r
1048                 \r
1049                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1050                 if ( !$member->canAlterItem($itemid) )\r
1051                 {\r
1052                         return _ERROR_DISALLOWED;\r
1053                 }\r
1054                 \r
1055                 // need to get blogid before the item is deleted\r
1056                 $blogid = getBlogIDFromItemId($itemid);\r
1057                 \r
1058                 $manager->loadClass('ITEM');\r
1059                 Item::delete($itemid);\r
1060                 \r
1061                 // update blog's futureposted\r
1062                 self::updateFuturePosted($blogid);\r
1063                 return;\r
1064         }\r
1065         \r
1066         /**\r
1067          * Admin::updateFuturePosted()\r
1068          * Update a blog's future posted flag\r
1069          * \r
1070          * @param integer $blogid\r
1071          * @return      void\r
1072          */\r
1073         static private function updateFuturePosted($blogid)\r
1074         {\r
1075                 global $manager;\r
1076                 \r
1077                 $blogid                 =  intval($blogid);\r
1078                 $blog                   =& $manager->getBlog($blogid);\r
1079                 $currenttime    =  $blog->getCorrectTime(time());\r
1080                 \r
1081                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1082                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1083                 $result = sql_query($query);\r
1084                 \r
1085                 if ( sql_num_rows($result) > 0 )\r
1086                 {\r
1087                                 $blog->setFuturePost();\r
1088                 }\r
1089                 else\r
1090                 {\r
1091                                 $blog->clearFuturePost();\r
1092                 }\r
1093                 return;\r
1094         }\r
1095 \r
1096         /**\r
1097          * Admin::action_itemmove()\r
1098          * \r
1099          * @param       void\r
1100          * @return      void\r
1101          */\r
1102         static private function action_itemmove()\r
1103         {\r
1104                 global $member, $manager;\r
1105                 \r
1106                 $itemid = intRequestVar('itemid');\r
1107                 \r
1108                 $member->canAlterItem($itemid) or self::disallow();\r
1109                 \r
1110                 self::pagehead();\r
1111                 self::$skin->parse('itemmove');\r
1112                 self::pagefoot();\r
1113                 return;\r
1114         }\r
1115         \r
1116         /**\r
1117          * Admin::action_itemmoveto()\r
1118          * \r
1119          * @param       void\r
1120          * @return      void\r
1121          */\r
1122         static private function action_itemmoveto()\r
1123         {\r
1124                 global $member, $manager;\r
1125                 \r
1126                 $itemid = intRequestVar('itemid');\r
1127                 $catid = requestVar('catid');\r
1128                 \r
1129                 // create new category if needed\r
1130                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1131                 {\r
1132                         // get blogid\r
1133                         list($blogid) = sscanf($catid,'newcat-%d');\r
1134                         \r
1135                         // create\r
1136                         $blog =& $manager->getBlog($blogid);\r
1137                         $catid = $blog->createNewCategory();\r
1138                         \r
1139                         // show error when sth goes wrong\r
1140                         if ( !$catid )\r
1141                         {\r
1142                                 self::doError(_ERROR_CATCREATEFAIL);\r
1143                         }\r
1144                 }\r
1145                 \r
1146                 // only allow if user is allowed to alter item\r
1147                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1148                 \r
1149                 $old_blogid = getBlogIDFromItemId($itemid);\r
1150                 \r
1151                 Item::move($itemid, $catid);\r
1152                 \r
1153                 // set the futurePosted flag on the blog\r
1154                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1155                 \r
1156                 // reset the futurePosted in case the item is moved from one blog to another\r
1157                 self::updateFuturePosted($old_blogid);\r
1158                 \r
1159                 if ( $catid != intRequestVar('catid') )\r
1160                 {\r
1161                         self::$action_categoryedit($catid, $blog->getID());\r
1162                 }\r
1163                 else\r
1164                 {\r
1165                         self::$action_itemlist(getBlogIDFromCatID($catid));\r
1166                 }\r
1167                 return;\r
1168         }\r
1169         \r
1170         /**\r
1171          * Admin::moveOneItem()\r
1172          * Moves one item to a given category (category existance should be checked by caller)\r
1173          * errors are returned\r
1174          * \r
1175          * @param       integer $itemid         ID for item\r
1176          * @param       integer $destCatid      ID for category to which the item will be moved\r
1177          * @return      void\r
1178          */\r
1179         static private function moveOneItem($itemid, $destCatid)\r
1180         {\r
1181                 global $member;\r
1182                 \r
1183                 // only allow if user is allowed to move item\r
1184                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1185                 {\r
1186                         return _ERROR_DISALLOWED;\r
1187                 }\r
1188                 \r
1189                 Item::move($itemid, $destCatid);\r
1190                 return;\r
1191         }\r
1192         \r
1193         /**\r
1194          * Admin::action_additem()\r
1195          * Adds a item to the chosen blog\r
1196          * \r
1197          * @param       void\r
1198          * @return      void\r
1199          */\r
1200         static private function action_additem()\r
1201         {\r
1202                 global $manager, $CONF;\r
1203                 \r
1204                 $manager->loadClass('ITEM');\r
1205                 \r
1206                 $result = Item::createFromRequest();\r
1207                 \r
1208                 if ( $result['status'] == 'error' )\r
1209                 {\r
1210                         self::error($result['message']);\r
1211                 }\r
1212                 \r
1213                 $blogid         =  getBlogIDFromItemID($result['itemid']);\r
1214                 $blog           =& $manager->getBlog($blogid);\r
1215                 $btimestamp     =  $blog->getCorrectTime();\r
1216                 $item           =  $manager->getItem(intval($result['itemid']), 1, 1);\r
1217                 \r
1218                 if ( $result['status'] == 'newcategory' )\r
1219                 {\r
1220                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));\r
1221                         self::$action_categoryedit($result['catid'], $blogid, $distURI);\r
1222                 }\r
1223                 else\r
1224                 {\r
1225                         $methodName = 'action_itemList';\r
1226                         call_user_func(array(&$this, $methodName), $blogid);\r
1227                 }\r
1228                 return;\r
1229         }\r
1230         \r
1231         /**\r
1232          * Admin::action_commentedit()\r
1233          * Allows to edit previously made comments\r
1234          * \r
1235          * @param       void\r
1236          * @return      void\r
1237          */\r
1238         static private function action_commentedit()\r
1239         {\r
1240                 global $member, $manager;\r
1241                 \r
1242                 $commentid = intRequestVar('commentid');\r
1243                 \r
1244                 $member->canAlterComment($commentid) or self::disallow();\r
1245                 \r
1246                 self::pagehead();\r
1247                 self::$skin->parse('commentedit');\r
1248                 self::pagefoot();\r
1249                 return;\r
1250         }\r
1251         \r
1252         /**\r
1253          * Admin::action_commentupdate()\r
1254          * \r
1255          * @param       void\r
1256          * @return      void\r
1257          */\r
1258         static private function action_commentupdate()\r
1259         {\r
1260                 global $member, $manager;\r
1261                 \r
1262                 $commentid = intRequestVar('commentid');\r
1263                 \r
1264                 $member->canAlterComment($commentid) or self::disallow();\r
1265                 \r
1266                 $url    = postVar('url');\r
1267                 $email  = postVar('email');\r
1268                 $body   = postVar('body');\r
1269                 \r
1270                 // intercept words that are too long\r
1271                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1272                 {\r
1273                         self::error(_ERROR_COMMENT_LONGWORD);\r
1274                 }\r
1275                 \r
1276                 // check length\r
1277                 if ( i18n::strlen($body) < 3 )\r
1278                 {\r
1279                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1280                 }\r
1281                 \r
1282                 if ( i18n::strlen($body) > 5000 )\r
1283                 {\r
1284                         self::error(_ERROR_COMMENT_TOOLONG);\r
1285                 }\r
1286                 \r
1287                 // prepare body\r
1288                 $body = Comment::prepareBody($body);\r
1289                 \r
1290                 // call plugins\r
1291                 $data = array(\r
1292                         'body' => &$body\r
1293                 );\r
1294                 $manager->notify('PreUpdateComment', $data);\r
1295                 \r
1296                 $query = "UPDATE %s SET cmail='%s', cemail  = '%s', cbody= '%s' WHERE cnumber=%d;";\r
1297                 $query = sprintf($query, sql_real_escape_string($url), sql_real_escape_string($url), sql_real_escape_string($url), (integer) $commentid);\r
1298                 sql_query($query);\r
1299                 \r
1300                 // get itemid\r
1301                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1302                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1303                 \r
1304                 $res    = sql_query($query);\r
1305                 $o              = sql_fetch_object($res);\r
1306                 $itemid = $o->citem;\r
1307                 \r
1308                 if ( $member->canAlterItem($itemid) )\r
1309                 {\r
1310                         self::$action_itemcommentlist($itemid);\r
1311                 }\r
1312                 else\r
1313                 {\r
1314                         self::$action_browseowncomments();\r
1315                 }\r
1316                 return;\r
1317         }\r
1318         \r
1319         /**\r
1320          * Admin::action_commentdelete()\r
1321          * Update comment\r
1322          * \r
1323          * @param       void\r
1324          * @return      void\r
1325          */\r
1326         static private function action_commentdelete()\r
1327         {\r
1328                 global $member, $manager;\r
1329                 \r
1330                 $commentid = intRequestVar('commentid');\r
1331                 $member->canAlterComment($commentid) or self::disallow();\r
1332                 \r
1333                 self::pagehead();\r
1334                 self::$skin->parse('commentdelete');\r
1335                 self::pagefoot();\r
1336                 return;\r
1337         }\r
1338         \r
1339         /**\r
1340          * Admin::action_commentdeleteconfirm()\r
1341          * \r
1342          * @param       void\r
1343          * @return      void\r
1344          */\r
1345         static private function action_commentdeleteconfirm()\r
1346         {\r
1347                 global $member;\r
1348                 \r
1349                 $commentid = intRequestVar('commentid');\r
1350                 \r
1351                 // get item id first\r
1352                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1353                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1354                 \r
1355                 $res = sql_query($query);\r
1356                 $o = sql_fetch_object($res);\r
1357                 $itemid = $o->citem;\r
1358                 \r
1359                 $error = self::deleteOneComment($commentid);\r
1360                 if ( $error )\r
1361                 {\r
1362                         self::doError($error);\r
1363                 }\r
1364                 \r
1365                 if ( $member->canAlterItem($itemid) )\r
1366                 {\r
1367                         self::$action_itemcommentlist($itemid);\r
1368                 }\r
1369                 else\r
1370                 {\r
1371                         self::$action_browseowncomments();\r
1372                 }\r
1373                 return;\r
1374         }\r
1375         \r
1376         /**\r
1377          * Admin::deleteOneComment()\r
1378          * \r
1379          * @param       integer $commentid      ID for comment\r
1380          * @return      void\r
1381          */\r
1382         static private function deleteOneComment($commentid)\r
1383         {\r
1384                 global $member, $manager;\r
1385                 \r
1386                 $commentid = (integer) $commentid;\r
1387                 \r
1388                 if ( !$member->canAlterComment($commentid) )\r
1389                 {\r
1390                         return _ERROR_DISALLOWED;\r
1391                 }\r
1392                 \r
1393                 $data = array(\r
1394                         'commentid' => $commentid\r
1395                 );\r
1396                 \r
1397                 $manager->notify('PreDeleteComment', $data);\r
1398                 \r
1399                 // delete the comments associated with the item\r
1400                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1401                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1402                 sql_query($query);\r
1403                 \r
1404                 $data = array(\r
1405                         'commentid' => $commentid\r
1406                 );\r
1407                 \r
1408                 $manager->notify('PostDeleteComment', $data);\r
1409                 \r
1410                 return '';\r
1411         }\r
1412         \r
1413         /**\r
1414          * Admin::action_usermanagement()\r
1415          * Usermanagement main\r
1416          * \r
1417          * @param       void\r
1418          * @return      void\r
1419          */\r
1420         static private function action_usermanagement()\r
1421         {\r
1422                 global $member, $manager;\r
1423                 \r
1424                 // check if allowed\r
1425                 $member->isAdmin() or self::disallow();\r
1426                 \r
1427                 self::pagehead();\r
1428                 self::$skin->parse('usermanagement');\r
1429                 self::pagefoot();\r
1430                 return;\r
1431         }\r
1432         \r
1433         /**\r
1434          * Admin::action_memberedit()\r
1435          * Edit member settings\r
1436          * \r
1437          * @param       void\r
1438          * @return      void\r
1439          */\r
1440         static private function action_memberedit()\r
1441         {\r
1442                 self::$action_editmembersettings(intRequestVar('memberid'));\r
1443                 return;\r
1444         }\r
1445         \r
1446         /**\r
1447          * Admin::action_editmembersettings()\r
1448          * \r
1449          * @param       integer $memberid       ID for member\r
1450          * @return      void\r
1451          * \r
1452          */\r
1453         static private function action_editmembersettings($memberid = '')\r
1454         {\r
1455                 global $member, $manager, $CONF;\r
1456                 \r
1457                 if ( $memberid == '' )\r
1458                 {\r
1459                         $memberid = $member->getID();\r
1460                 }\r
1461                 \r
1462                 /* TODO: we should consider to use the other way insterad of this */\r
1463                 $_REQUEST['memberid'] = $memberid;\r
1464                 \r
1465                 // check if allowed\r
1466                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1467                 \r
1468                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1469                 self::pagehead($extrahead);\r
1470                 self::$skin->parse('editmembersettings');\r
1471                 self::pagefoot();\r
1472                 return;\r
1473         }\r
1474         \r
1475         /**\r
1476          * Admin::action_changemembersettings()\r
1477          * \r
1478          * @param       void\r
1479          * @return      void\r
1480          */\r
1481         static private function action_changemembersettings()\r
1482         {\r
1483                 global $member, $CONF, $manager;\r
1484                 \r
1485                 $memberid = intRequestVar('memberid');\r
1486                 \r
1487                 // check if allowed\r
1488                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1489                 \r
1490                 $name                   = trim(strip_tags(postVar('name')));\r
1491                 $realname               = trim(strip_tags(postVar('realname')));\r
1492                 $password               = postVar('password');\r
1493                 $repeatpassword = postVar('repeatpassword');\r
1494                 $email                  = strip_tags(postVar('email'));\r
1495                 $url                    = strip_tags(postVar('url'));\r
1496                 $adminskin              = intPostVar('adminskin');\r
1497                 \r
1498                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1499                 if ( !preg_match('#^https?://#', $url) )\r
1500                 {\r
1501                         $url = 'http://' . $url;\r
1502                 }\r
1503                 \r
1504                 $admin          = postVar('admin');\r
1505                 $canlogin       = postVar('canlogin');\r
1506                 $notes          = strip_tags(postVar('notes'));\r
1507                 $locale         = postVar('locale');\r
1508                 \r
1509                 $mem = Member::createFromID($memberid);\r
1510                 \r
1511                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1512                 {\r
1513                         if ( !isValidDisplayName($name) )\r
1514                         {\r
1515                                 self::error(_ERROR_BADNAME);\r
1516                         }\r
1517                         \r
1518                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1519                         {\r
1520                                 self::error(_ERROR_NICKNAMEINUSE);\r
1521                         }\r
1522                         \r
1523                         if ( $password != $repeatpassword )\r
1524                         {\r
1525                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1526                         }\r
1527                         \r
1528                         if ( $password && (i18n::strlen($password) < 6) )\r
1529                         {\r
1530                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1531                         }\r
1532                                 \r
1533                         if ( $password )\r
1534                         {\r
1535                                 $pwdvalid = true;\r
1536                                 $pwderror = '';\r
1537                                 \r
1538                                 $data = array(\r
1539                                         'password'     => $password,\r
1540                                         'errormessage' => &$pwderror,\r
1541                                         'valid'        => &$pwdvalid\r
1542                                 );\r
1543                                 $manager->notify('PrePasswordSet', $data);\r
1544                                 \r
1545                                 if ( !$pwdvalid )\r
1546                                 {\r
1547                                         self::error($pwderror);\r
1548                                 }\r
1549                         }\r
1550                 }\r
1551                 \r
1552                 if ( !NOTIFICATION::address_validation($email) )\r
1553                 {\r
1554                         self::error(_ERROR_BADMAILADDRESS);\r
1555                 }\r
1556                 if ( !$realname )\r
1557                 {\r
1558                         self::error(_ERROR_REALNAMEMISSING);\r
1559                 }\r
1560                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1561                 {\r
1562                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1563                 }\r
1564                 \r
1565                 // check if there will remain at least one site member with both the logon and admin rights\r
1566                 // (check occurs when taking away one of these rights from such a member)\r
1567                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1568                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1569                         )\r
1570                 {\r
1571                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1572                         if ( sql_num_rows($r) < 2 )\r
1573                         {\r
1574                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1575                         }\r
1576                 }\r
1577                 \r
1578                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1579                 {\r
1580                         $mem->setDisplayName($name);\r
1581                         if ( $password )\r
1582                         {\r
1583                                 $mem->setPassword($password);\r
1584                         }\r
1585                 }\r
1586                 \r
1587                 $oldEmail = $mem->getEmail();\r
1588                 \r
1589                 $mem->setRealName($realname);\r
1590                 $mem->setEmail($email);\r
1591                 $mem->setURL($url);\r
1592                 $mem->setNotes($notes);\r
1593                 $mem->setLocale($locale);\r
1594                 \r
1595                 // only allow super-admins to make changes to the admin status\r
1596                 if ( $member->isAdmin() )\r
1597                 {\r
1598                         $mem->setAdmin($admin);\r
1599                         $mem->setCanLogin($canlogin);\r
1600                 }\r
1601                 \r
1602                 $autosave = postVar('autosave');\r
1603                 $mem->setAutosave($autosave);\r
1604                 \r
1605                 $mem->write();\r
1606                 \r
1607                 // store plugin options\r
1608                 $aOptions = requestArray('plugoption');\r
1609                 NucleusPlugin::apply_plugin_options($aOptions);\r
1610                 $data = array(\r
1611                         'context'  => 'member',\r
1612                         'memberid' => $memberid,\r
1613                         'member'   => &$mem\r
1614                 );\r
1615                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1616                 \r
1617                 // if email changed, generate new password\r
1618                 if ( $oldEmail != $mem->getEmail() )\r
1619                 {\r
1620                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1621                         // logout member\r
1622                         $mem->newCookieKey();\r
1623                         \r
1624                         // only log out if the member being edited is the current member.\r
1625                         if ( $member->getID() == $memberid )\r
1626                         {\r
1627                                 $member->logout();\r
1628                         }\r
1629                         self::$action_login(_MSG_ACTIVATION_SENT, 0);\r
1630                         return;\r
1631                 }\r
1632                 \r
1633                 if ( ($mem->getID() == $member->getID())\r
1634                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1635                 {\r
1636                         $mem->newCookieKey();\r
1637                         $member->logout();\r
1638                         self::$action_login(_MSG_LOGINAGAIN, 0);\r
1639                 }\r
1640                 else\r
1641                 {\r
1642                         self::$action_overview(_MSG_SETTINGSCHANGED);\r
1643                 }\r
1644                 return;\r
1645         }\r
1646 \r
1647         /**\r
1648          * Admin::action_memberadd()\r
1649          * \r
1650          * @param       void\r
1651          * @return      void\r
1652          * \r
1653          */\r
1654         static private function action_memberadd()\r
1655         {\r
1656                 global $member, $manager;\r
1657                 \r
1658                 // check if allowed\r
1659                 $member->isAdmin() or self::disallow();\r
1660                 \r
1661                 if ( postVar('password') != postVar('repeatpassword') )\r
1662                 {\r
1663                         self::error(_ERROR_PASSWORDMISMATCH);\r
1664                 }\r
1665                 \r
1666                 if ( i18n::strlen(postVar('password')) < 6 )\r
1667                 {\r
1668                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1669                 }\r
1670                 \r
1671                 $res = Member::create(\r
1672                         postVar('name'),\r
1673                         postVar('realname'),\r
1674                         postVar('password'),\r
1675                         postVar('email'),\r
1676                         postVar('url'),\r
1677                         postVar('admin'),\r
1678                         postVar('canlogin'),\r
1679                         postVar('notes')\r
1680                 );\r
1681                 \r
1682                 if ( $res != 1 )\r
1683                 {\r
1684                         self::error($res);\r
1685                 }\r
1686                 \r
1687                 // fire PostRegister event\r
1688                 $newmem = new Member();\r
1689                 $newmem->readFromName(postVar('name'));\r
1690                 $data = array(\r
1691                         'member' => &$newmem\r
1692                 );\r
1693                 $manager->notify('PostRegister', $data);\r
1694                 \r
1695                 self::$action_usermanagement();\r
1696                 return;\r
1697         }\r
1698         \r
1699         /**\r
1700          * Admin::action_activate()\r
1701          * Account activation\r
1702          * \r
1703          * @param       void\r
1704          * @return      void\r
1705          */\r
1706         static private function action_activate()\r
1707         {\r
1708                 $key = getVar('key');\r
1709                 self::showActivationPage($key);\r
1710                 return;\r
1711         }\r
1712         \r
1713         /**\r
1714          * Admin::showActivationPage()\r
1715          * \r
1716          * @param       void\r
1717          * @return      void\r
1718          */\r
1719         static private function showActivationPage($key, $message = '')\r
1720         {\r
1721                 global $manager;\r
1722                 \r
1723                 // clean up old activation keys\r
1724                 Member::cleanupActivationTable();\r
1725                 \r
1726                 // get activation info\r
1727                 $info = Member::getActivationInfo($key);\r
1728                 \r
1729                 if ( !$info )\r
1730                 {\r
1731                         self::error(_ERROR_ACTIVATE);\r
1732                 }\r
1733                 \r
1734                 $mem = Member::createFromId($info->vmember);\r
1735                 \r
1736                 if ( !$mem )\r
1737                 {\r
1738                         self::error(_ERROR_ACTIVATE);\r
1739                 }\r
1740                 \r
1741                 /* TODO: we should consider to use the other way insterad of this */\r
1742                 $_POST['ackey']                                 = $key;\r
1743                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1744                 \r
1745                 self::$headMess = $message;\r
1746                 self::pagehead();\r
1747                 self::$skin->parse('activate');\r
1748                 self::pagefoot();\r
1749                 return;\r
1750         }\r
1751         \r
1752         /**\r
1753          * Admin::action_activatesetpwd()\r
1754          * Account activation - set password part\r
1755          * \r
1756          * @param       void\r
1757          * @return      void\r
1758          */\r
1759         static private function action_activatesetpwd()\r
1760         {\r
1761                 global $manager;\r
1762                 $key = postVar('key');\r
1763                 \r
1764                 // clean up old activation keys\r
1765                 Member::cleanupActivationTable();\r
1766                 \r
1767                 // get activation info\r
1768                 $info = Member::getActivationInfo($key);\r
1769                 \r
1770                 if ( !$info || ($info->type == 'addresschange') )\r
1771                 {\r
1772                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1773                 }\r
1774                 \r
1775                 $mem = Member::createFromId($info->vmember);\r
1776                 \r
1777                 if ( !$mem )\r
1778                 {\r
1779                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1780                 }\r
1781                 \r
1782                 $password               = postVar('password');\r
1783                 $repeatpassword = postVar('repeatpassword');\r
1784                 \r
1785                 if ( $password != $repeatpassword )\r
1786                 {\r
1787                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1788                 }\r
1789                 \r
1790                 if ( $password && (i18n::strlen($password) < 6) )\r
1791                 {\r
1792                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1793                 }\r
1794                         \r
1795                 if ( $password )\r
1796                 {\r
1797                         $pwdvalid = true;\r
1798                         $pwderror = '';\r
1799                         \r
1800                         $data = array(\r
1801                                 'password'              => $password,\r
1802                                 'errormessage'  => &$pwderror,\r
1803                                 'valid'                 => &$pwdvalid\r
1804                         );\r
1805                         $manager->notify('PrePasswordSet', $data);\r
1806                         if ( !$pwdvalid )\r
1807                         {\r
1808                                 return self::showActivationPage($key,$pwderror);\r
1809                         }\r
1810                 }\r
1811                 \r
1812                 $error = '';\r
1813                 \r
1814                 $data = array(\r
1815                         'type'   => 'activation',\r
1816                         'member' => $mem,\r
1817                         'error'  => &$error\r
1818                 );\r
1819                 $manager->notify('ValidateForm', $data);\r
1820                 if ( $error != '' )\r
1821                 {\r
1822                         return self::showActivationPage($key, $error);\r
1823                 }\r
1824                 \r
1825                 // set password\r
1826                 $mem->setPassword($password);\r
1827                 $mem->write();\r
1828                 \r
1829                 // do the activation\r
1830                 Member::activate($key);\r
1831                 \r
1832                 self::pagehead();\r
1833                 self::$skin->parse('activatesetpwd');\r
1834                 self::pagefoot();\r
1835                 return;\r
1836         }\r
1837         \r
1838         /**\r
1839          * Admin::action_manageteam()\r
1840          * Manage team\r
1841          * \r
1842          * @param       void\r
1843          * @return      void\r
1844          */\r
1845         static private function action_manageteam()\r
1846         {\r
1847                 global $member, $manager;\r
1848                 \r
1849                 $blogid = intRequestVar('blogid');\r
1850                 \r
1851                 // check if allowed\r
1852                 $member->blogAdminRights($blogid) or self::disallow();\r
1853                 \r
1854                 self::pagehead();\r
1855                 self::$skin->parse('manageteam');\r
1856                 self::pagefoot();\r
1857                 return;\r
1858         }\r
1859         \r
1860         /**\r
1861          * Admin::action_teamaddmember()\r
1862          * Add member to team\r
1863          * \r
1864          * @param       void\r
1865          * @return      void\r
1866          */\r
1867         static private function action_teamaddmember()\r
1868         {\r
1869                 global $member, $manager;\r
1870                 \r
1871                 $memberid       = intPostVar('memberid');\r
1872                 $blogid         = intPostVar('blogid');\r
1873                 $admin          = intPostVar('admin');\r
1874                 \r
1875                 // check if allowed\r
1876                 $member->blogAdminRights($blogid) or self::disallow();\r
1877                 \r
1878                 $blog =& $manager->getBlog($blogid);\r
1879                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1880                 {\r
1881                         self::error(_ERROR_ALREADYONTEAM);\r
1882                 }\r
1883                 \r
1884                 self::$action_manageteam();\r
1885                 return;\r
1886         }\r
1887         \r
1888         /**\r
1889          * Admin::action_teamdelete()\r
1890          * \r
1891          * @param       void\r
1892          * @return      void\r
1893          */\r
1894         static private function action_teamdelete()\r
1895         {\r
1896                 global $member, $manager;\r
1897                 \r
1898                 $memberid       = intRequestVar('memberid');\r
1899                 $blogid         = intRequestVar('blogid');\r
1900                 \r
1901                 // check if allowed\r
1902                 $member->blogAdminRights($blogid) or self::disallow();\r
1903                 \r
1904                 $teammem =  Member::createFromID($memberid);\r
1905                 $blog =& $manager->getBlog($blogid);\r
1906                 \r
1907                 self::pagehead();\r
1908                 self::$skin->parse('teamdelete');\r
1909                 self::pagefoot();\r
1910                 return;\r
1911         }\r
1912         \r
1913         /**\r
1914          * Admin::action_teamdeleteconfirm()\r
1915          * \r
1916          * @param       void\r
1917          * @return      void\r
1918          */\r
1919         static private function action_teamdeleteconfirm()\r
1920         {\r
1921                 global $member;\r
1922                 \r
1923                 $memberid = intRequestVar('memberid');\r
1924                 $blogid = intRequestVar('blogid');\r
1925                 \r
1926                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1927                 if ( $error )\r
1928                 {\r
1929                         self::error($error);\r
1930                 }\r
1931                 self::$action_manageteam();\r
1932                 return;\r
1933         }\r
1934         \r
1935         /**\r
1936          * Admin::deleteOneTeamMember()\r
1937          * \r
1938          * @param       void\r
1939          * @return      void\r
1940          */\r
1941         static private function deleteOneTeamMember($blogid, $memberid)\r
1942         {\r
1943                 global $member, $manager;\r
1944                 \r
1945                 $blogid   = intval($blogid);\r
1946                 $memberid = intval($memberid);\r
1947                 \r
1948                 // check if allowed\r
1949                 if ( !$member->blogAdminRights($blogid) )\r
1950                 {\r
1951                         return _ERROR_DISALLOWED;\r
1952                 }\r
1953                 \r
1954                 // check if: - there remains at least one blog admin\r
1955                 //           - (there remains at least one team member)\r
1956                 $tmem = Member::createFromID($memberid);\r
1957                 \r
1958                 \r
1959                 $data = array(\r
1960                         'member' => &$tmem,\r
1961                         'blogid' => $blogid\r
1962                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1963                 \r
1964                 if ( $tmem->isBlogAdmin($blogid) )\r
1965                 {\r
1966                         /* TODO: why we did double check? */\r
1967                         // check if there are more blog members left and at least one admin\r
1968                         // (check for at least two admins before deletion)\r
1969                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1970                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1971                         $r     = sql_query($query);\r
1972                         if ( sql_num_rows($r) < 2 )\r
1973                         {\r
1974                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1975                         }\r
1976                 }\r
1977                 \r
1978                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1979                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1980                 sql_query($query);\r
1981                 \r
1982                 $data = array(\r
1983                         'member' => &$tmem,\r
1984                         'blogid' => $blogid\r
1985                 );\r
1986                 $manager->notify('PostDeleteTeamMember', $data);\r
1987                 \r
1988                 return '';\r
1989         }\r
1990         \r
1991         /**\r
1992          * Admin::action_teamchangeadmin()\r
1993          * \r
1994          * @param       void\r
1995          * @return      void\r
1996          */\r
1997         static private function action_teamchangeadmin()\r
1998         {\r
1999                 global $member;\r
2000                 \r
2001                 $blogid         = intRequestVar('blogid');\r
2002                 $memberid       = intRequestVar('memberid');\r
2003                 \r
2004                 // check if allowed\r
2005                 $member->blogAdminRights($blogid) or self::disallow();\r
2006                 \r
2007                 $mem = Member::createFromID($memberid);\r
2008                 \r
2009                 // don't allow when there is only one admin at this moment\r
2010                 if ( $mem->isBlogAdmin($blogid) )\r
2011                 {\r
2012                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2013                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2014                         $r = sql_query($query);\r
2015                         if ( sql_num_rows($r) == 1 )\r
2016                         {\r
2017                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2018                         }\r
2019                 }\r
2020                 \r
2021                 if ( $mem->isBlogAdmin($blogid) )\r
2022                 {\r
2023                         $newval = 0;\r
2024                 }\r
2025                 else\r
2026                 {\r
2027                         $newval = 1;\r
2028                 }\r
2029                 \r
2030                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2031                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2032                 sql_query($query);\r
2033                 \r
2034                 // only show manageteam if member did not change its own admin privileges\r
2035                 if ( $member->isBlogAdmin($blogid) )\r
2036                 {\r
2037                         self::$action_manageteam();\r
2038                 }\r
2039                 else\r
2040                 {\r
2041                         self::$action_overview(_MSG_ADMINCHANGED);\r
2042                 }\r
2043                 return;\r
2044         }\r
2045         \r
2046         /**\r
2047          * Admin::action_blogsettings()\r
2048          * \r
2049          * @param       void\r
2050          * @return      void\r
2051          */\r
2052         static private function action_blogsettings()\r
2053         {\r
2054                 global $member, $manager;\r
2055                 \r
2056                 $blogid = intRequestVar('blogid');\r
2057                 \r
2058                 // check if allowed\r
2059                 $member->blogAdminRights($blogid) or self::disallow();\r
2060                 \r
2061                 $blog =& $manager->getBlog($blogid);\r
2062                 \r
2063                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2064                 self::pagehead($extrahead);\r
2065                 self::$skin->parse('blogsettings');\r
2066                 self::pagefoot();\r
2067                 return;\r
2068         }\r
2069         \r
2070         /**\r
2071          * Admin::action_categorynew()\r
2072          * \r
2073          * @param       void\r
2074          * @return      void\r
2075          */\r
2076         static private function action_categorynew()\r
2077         {\r
2078                 global $member, $manager;\r
2079                 \r
2080                 $blogid = intRequestVar('blogid');\r
2081                 \r
2082                 $member->blogAdminRights($blogid) or self::disallow();\r
2083                 \r
2084                 $cname = postVar('cname');\r
2085                 $cdesc = postVar('cdesc');\r
2086                 \r
2087                 if ( !isValidCategoryName($cname) )\r
2088                 {\r
2089                         self::error(_ERROR_BADCATEGORYNAME);\r
2090                 }\r
2091                 \r
2092                 $query = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d;";\r
2093                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid);\r
2094                 $res = sql_query($query);\r
2095                 if ( sql_num_rows($res) > 0 )\r
2096                 {\r
2097                         self::error(_ERROR_DUPCATEGORYNAME);\r
2098                 }\r
2099                 \r
2100                 $blog           =& $manager->getBlog($blogid);\r
2101                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2102                 \r
2103                 self::$action_blogsettings();\r
2104                 return;\r
2105         }\r
2106         \r
2107         /**\r
2108          * Admin::action_categoryedit()\r
2109          * \r
2110          * @param       void\r
2111          * @return      void\r
2112          */\r
2113         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2114         {\r
2115                 global $member, $manager;\r
2116                 \r
2117                 if ( $blogid == '' )\r
2118                 {\r
2119                         $blogid = intGetVar('blogid');\r
2120                 }\r
2121                 else\r
2122                 {\r
2123                         $blogid = intval($blogid);\r
2124                 }\r
2125                 if ( $catid == '' )\r
2126                 {\r
2127                         $catid = intGetVar('catid');\r
2128                 }\r
2129                 else\r
2130                 {\r
2131                         $catid = intval($catid);\r
2132                 }\r
2133                 \r
2134                 /* TODO: we should consider to use the other way insterad of this */\r
2135                 $_REQUEST['blogid']             = $blogid;\r
2136                 $_REQUEST['catid']              = $catid;\r
2137                 $_REQUEST['desturl']    = $desturl;\r
2138                 $member->blogAdminRights($blogid) or self::disallow();\r
2139                 \r
2140                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2141                 self::pagehead($extrahead);\r
2142                 self::$skin->parse('categoryedit');\r
2143                 self::pagefoot();\r
2144                 return;\r
2145         }\r
2146         \r
2147         /**\r
2148          * Admin::action_categoryupdate()\r
2149          * \r
2150          * @param       void\r
2151          * @return      void\r
2152          */\r
2153         static private function action_categoryupdate()\r
2154         {\r
2155                 global $member, $manager;\r
2156                 \r
2157                 $blogid         = intPostVar('blogid');\r
2158                 $catid          = intPostVar('catid');\r
2159                 $cname          = postVar('cname');\r
2160                 $cdesc          = postVar('cdesc');\r
2161                 $desturl        = postVar('desturl');\r
2162                 \r
2163                 $member->blogAdminRights($blogid) or self::disallow();\r
2164                 \r
2165                 if ( !isValidCategoryName($cname) )\r
2166                 {\r
2167                         self::error(_ERROR_BADCATEGORYNAME);\r
2168                 }\r
2169                 \r
2170                 $query  = "SELECT * FROM %s WHERE cname='%s' AND cblog=%d AND not(catid=%d);";\r
2171                 $query  = sprintf($query, sql_table('category'), sql_real_escape_string($cname), (integer) $blogid, (integer) $catid);\r
2172                 $res    = sql_query($query);\r
2173                 if ( sql_num_rows($res) > 0 )\r
2174                 {\r
2175                         self::error(_ERROR_DUPCATEGORYNAME);\r
2176                 }\r
2177                 \r
2178                 $query =  "UPDATE %s SET cname='%s', cdesc='%s' WHERE catid=%d;";\r
2179                 $query = sprintf($query, sql_table('category'), sql_real_escape_string($cname), sql_real_escape_string($cdesc), (integer) $catid);\r
2180                 sql_query($query);\r
2181                 \r
2182                 // store plugin options\r
2183                 $aOptions = requestArray('plugoption');\r
2184                 NucleusPlugin::apply_plugin_options($aOptions);\r
2185                 $data = array(\r
2186                         'context'       => 'category',\r
2187                         'catid'         => $catid\r
2188                 );\r
2189                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2190                 \r
2191                 if ( $desturl )\r
2192                 {\r
2193                         redirect($desturl);\r
2194                         exit;\r
2195                 }\r
2196                 else\r
2197                 {\r
2198                         self::$action_blogsettings();\r
2199                 }\r
2200                 return;\r
2201         }\r
2202         \r
2203         /**\r
2204          * Admin::action_categorydelete()\r
2205          * \r
2206          * @param       void\r
2207          * @return      void\r
2208          */\r
2209         static private function action_categorydelete()\r
2210         {\r
2211                 global $member, $manager;\r
2212                 \r
2213                 $blogid = intRequestVar('blogid');\r
2214                 $catid  = intRequestVar('catid');\r
2215                 \r
2216                 $member->blogAdminRights($blogid) or self::disallow();\r
2217                 \r
2218                 $blog =& $manager->getBlog($blogid);\r
2219                 \r
2220                 // check if the category is valid\r
2221                 if ( !$blog->isValidCategory($catid) )\r
2222                 {\r
2223                         self::error(_ERROR_NOSUCHCATEGORY);\r
2224                 }\r
2225                 \r
2226                 // don't allow deletion of default category\r
2227                 if ( $blog->getDefaultCategory() == $catid )\r
2228                 {\r
2229                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2230                 }\r
2231                 \r
2232                 // check if catid is the only category left for blogid\r
2233                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2234                 $query = sprintf($query, sql_table('category'), $blogid);\r
2235                 $res = sql_query($query);\r
2236                 if ( sql_num_rows($res) == 1 )\r
2237                 {\r
2238                         self::error(_ERROR_DELETELASTCATEGORY);\r
2239                 }\r
2240                 \r
2241                 self::pagehead();\r
2242                 self::$skin->parse('categorydelete');\r
2243                 self::pagefoot();\r
2244                 return;\r
2245         }\r
2246         \r
2247         /**\r
2248          * Admin::action_categorydeleteconfirm()\r
2249          * \r
2250          * @param       void\r
2251          * @return      void\r
2252          */\r
2253         static private function action_categorydeleteconfirm()\r
2254         {\r
2255                 global $member, $manager;\r
2256                 \r
2257                 $blogid = intRequestVar('blogid');\r
2258                 $catid  = intRequestVar('catid');\r
2259                 \r
2260                 $member->blogAdminRights($blogid) or self::disallow();\r
2261                 \r
2262                 $error = self::deleteOneCategory($catid);\r
2263                 if ( $error )\r
2264                 {\r
2265                         self::error($error);\r
2266                 }\r
2267                 \r
2268                 self::$action_blogsettings();\r
2269                 return;\r
2270         }\r
2271         \r
2272         /**\r
2273          * Admin::deleteOneCategory()\r
2274          * Delete a category by its id\r
2275          * \r
2276          * @param       String  $catid  category id for deleting\r
2277          * @return      Void\r
2278          */\r
2279         static private function deleteOneCategory($catid)\r
2280         {\r
2281                 global $manager, $member;\r
2282                 \r
2283                 $catid  = intval($catid);\r
2284                 $blogid = getBlogIDFromCatID($catid);\r
2285                 \r
2286                 if ( !$member->blogAdminRights($blogid) )\r
2287                 {\r
2288                         return ERROR_DISALLOWED;\r
2289                 }\r
2290                 \r
2291                 // get blog\r
2292                 $blog =& $manager->getBlog($blogid);\r
2293                 \r
2294                 // check if the category is valid\r
2295                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2296                 {\r
2297                         return _ERROR_NOSUCHCATEGORY;\r
2298                 }\r
2299                 \r
2300                 $destcatid = $blog->getDefaultCategory();\r
2301                 \r
2302                 // don't allow deletion of default category\r
2303                 if ( $blog->getDefaultCategory() == $catid )\r
2304                 {\r
2305                         return _ERROR_DELETEDEFCATEGORY;\r
2306                 }\r
2307                 \r
2308                 // check if catid is the only category left for blogid\r
2309                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2310                 $query = sprintf(sql_table('category'), (integer) $blogid);\r
2311                 \r
2312                 $res = sql_query($query);\r
2313                 if ( sql_num_rows($res) == 1 )\r
2314                 {\r
2315                         return _ERROR_DELETELASTCATEGORY;\r
2316                 }\r
2317                 \r
2318                 $data = array('catid' => $catid);\r
2319                 $manager->notify('PreDeleteCategory', $data);\r
2320                 \r
2321                 // change category for all items to the default category\r
2322                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2323                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2324                 sql_query($query);\r
2325                 \r
2326                 // delete all associated plugin options\r
2327                 NucleusPlugin::delete_option_values('category', $catid);\r
2328                 \r
2329                 // delete category\r
2330                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2331                 $query = sprintf($query, (integer) $catid);\r
2332                 sql_query($query);\r
2333                 \r
2334                 $data = array('catid' => $catid);\r
2335                 $manager->notify('PostDeleteCategory', $data);\r
2336                 return;\r
2337         }\r
2338         \r
2339         /**\r
2340          * Admin::action_blogsettingsupdate\r
2341          * Updating blog settings\r
2342          * \r
2343          * @param       Void\r
2344          * @return      Void\r
2345          */\r
2346         static private function action_blogsettingsupdate()\r
2347         {\r
2348                 global $member, $manager;\r
2349                 \r
2350                 $blogid = intRequestVar('blogid');\r
2351                 \r
2352                 $member->blogAdminRights($blogid) or self::disallow();\r
2353                 \r
2354                 $blog =& $manager->getBlog($blogid);\r
2355                 \r
2356                 $notify_address = trim(postVar('notify'));\r
2357                 $shortname              = trim(postVar('shortname'));\r
2358                 $updatefile             = trim(postVar('update'));\r
2359                 \r
2360                 $notifyComment  = intPostVar('notifyComment');\r
2361                 $notifyVote             = intPostVar('notifyVote');\r
2362                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2363                 \r
2364                 if ( $notifyComment == 0 )\r
2365                 {\r
2366                         $notifyComment = 1;\r
2367                 }\r
2368                 if ( $notifyVote == 0 )\r
2369                 {\r
2370                         $notifyVote = 1;\r
2371                 }\r
2372                 if ( $notifyNewItem == 0 )\r
2373                 {\r
2374                         $notifyNewItem = 1;\r
2375                 }\r
2376                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2377                 \r
2378                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2379                 {\r
2380                         self::error(_ERROR_BADNOTIFY);\r
2381                 }\r
2382                 \r
2383                 if ( !isValidShortName($shortname) )\r
2384                 {\r
2385                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2386                 }\r
2387                 \r
2388                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2389                 {\r
2390                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2391                 }\r
2392                 // check if update file is writable\r
2393                 if ( $updatefile && !is_writeable($updatefile) )\r
2394                 {\r
2395                         self::error(_ERROR_UPDATEFILE);\r
2396                 }\r
2397                 \r
2398                 $blog->setName(trim(postVar('name')));\r
2399                 $blog->setShortName($shortname);\r
2400                 $blog->setNotifyAddress($notify_address);\r
2401                 $blog->setNotifyType($notifyType);\r
2402                 $blog->setMaxComments(postVar('maxcomments'));\r
2403                 $blog->setCommentsEnabled(postVar('comments'));\r
2404                 $blog->setTimeOffset(postVar('timeoffset'));\r
2405                 $blog->setUpdateFile($updatefile);\r
2406                 $blog->setURL(trim(postVar('url')));\r
2407                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2408                 $blog->setDescription(trim(postVar('desc')));\r
2409                 $blog->setPublic(postVar('public'));\r
2410                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2411                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2412                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2413                 $blog->setSearchable(intPostVar('searchable'));\r
2414                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2415                 $blog->writeSettings();\r
2416                 \r
2417                 // store plugin options\r
2418                 $aOptions = requestArray('plugoption');\r
2419                 NucleusPlugin::apply_plugin_options($aOptions);\r
2420                 \r
2421                 $data = array(\r
2422                         'context' => 'blog',\r
2423                         'blogid'  => $blogid,\r
2424                         'blog'    => &$blog\r
2425                 );\r
2426                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2427                 \r
2428                 self::$action_overview(_MSG_SETTINGSCHANGED);\r
2429                 return;\r
2430         }\r
2431         \r
2432         /**\r
2433          * Admin::action_deleteblog()\r
2434          * \r
2435          * @param       void\r
2436          * @return      void\r
2437          */\r
2438         static private function action_deleteblog()\r
2439         {\r
2440                 global $member, $CONF, $manager;\r
2441                 \r
2442                 $blogid = intRequestVar('blogid');\r
2443                 \r
2444                 $member->blogAdminRights($blogid) or self::disallow();\r
2445                 \r
2446                 // check if blog is default blog\r
2447                 if ( $CONF['DefaultBlog'] == $blogid )\r
2448                 {\r
2449                         self::error(_ERROR_DELDEFBLOG);\r
2450                 }\r
2451                 \r
2452                 $blog =& $manager->getBlog($blogid);\r
2453                 \r
2454                 self::pagehead();\r
2455                 self::$skin->parse('deleteblog');\r
2456                 self::pagefoot();\r
2457                 return;\r
2458         }\r
2459         \r
2460         /**\r
2461          * Admin::action_deleteblogconfirm()\r
2462          * Delete Blog\r
2463          * \r
2464          * @param       Void\r
2465          * @return      Void\r
2466          */\r
2467         static private function action_deleteblogconfirm()\r
2468         {\r
2469                 global $member, $CONF, $manager;\r
2470                 \r
2471                 $blogid = intRequestVar('blogid');\r
2472                 \r
2473                 $data = array('blogid' => $blogid);\r
2474                 $manager->notify('PreDeleteBlog', $data);\r
2475                 \r
2476                 $member->blogAdminRights($blogid) or self::disallow();\r
2477                 \r
2478                 // check if blog is default blog\r
2479                 if ( $CONF['DefaultBlog'] == $blogid )\r
2480                 {\r
2481                         self::error(_ERROR_DELDEFBLOG);\r
2482                 }\r
2483                 \r
2484                 // delete all comments\r
2485                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2486                 sql_query($query);\r
2487                 \r
2488                 // delete all items\r
2489                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2490                 sql_query($query);\r
2491                 \r
2492                 // delete all team members\r
2493                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2494                 sql_query($query);\r
2495                 \r
2496                 // delete all bans\r
2497                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2498                 sql_query($query);\r
2499                 \r
2500                 // delete all categories\r
2501                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2502                 sql_query($query);\r
2503                 \r
2504                 // delete all associated plugin options\r
2505                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2506                 \r
2507                 // delete the blog itself\r
2508                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2509                 sql_query($query);\r
2510                 \r
2511                 $data = array('blogid' => $blogid);\r
2512                 $manager->notify('PostDeleteBlog', $data);\r
2513                 \r
2514                 self::$action_overview(_DELETED_BLOG);\r
2515                 return;\r
2516         }\r
2517         \r
2518         /**\r
2519          * Admin::action_memberdelete()\r
2520          * \r
2521          * @param       void\r
2522          * @return      void\r
2523          */\r
2524         static private function action_memberdelete()\r
2525         {\r
2526                 global $member, $manager;\r
2527                 \r
2528                 $memberid = intRequestVar('memberid');\r
2529                 \r
2530                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2531                 \r
2532                 $mem = Member::createFromID($memberid);\r
2533                 \r
2534                 self::pagehead();\r
2535                 self::$skin->parse('memberdelete');\r
2536                 self::pagefoot();\r
2537                 return;\r
2538         }\r
2539         \r
2540         /**\r
2541          * Admin::action_memberdeleteconfirm()\r
2542          * \r
2543          * @param       void\r
2544          * @return      void\r
2545          */\r
2546         static private function action_memberdeleteconfirm()\r
2547         {\r
2548                 global $member;\r
2549                 \r
2550                 $memberid = intRequestVar('memberid');\r
2551                 \r
2552                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2553                 \r
2554                 $error = self::deleteOneMember($memberid);\r
2555                 if ( $error )\r
2556                 {\r
2557                         self::error($error);\r
2558                 }\r
2559                 \r
2560                 if ( $member->isAdmin() )\r
2561                 {\r
2562                         self::$action_usermanagement();\r
2563                 }\r
2564                 else\r
2565                 {\r
2566                         self::$action_overview(_DELETED_MEMBER);\r
2567                 }\r
2568                 return;\r
2569         }\r
2570         \r
2571         /**\r
2572          * Admin::deleteOneMember()\r
2573          * Delete a member by id\r
2574          * \r
2575          * @static\r
2576          * @params      Integer $memberid       member id\r
2577          * @return      String  null string or error messages\r
2578          */\r
2579         static private function deleteOneMember($memberid)\r
2580         {\r
2581                 global $manager;\r
2582                 \r
2583                 $memberid = intval($memberid);\r
2584                 $mem = Member::createFromID($memberid);\r
2585                 \r
2586                 if ( !$mem->canBeDeleted() )\r
2587                 {\r
2588                         return _ERROR_DELETEMEMBER;\r
2589                 }\r
2590                 \r
2591                 $data = array('member' => &$mem);\r
2592                 $manager->notify('PreDeleteMember', $data);\r
2593                 \r
2594                 /* unlink comments from memberid */\r
2595                 if ( $memberid )\r
2596                 {\r
2597                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d;";\r
2598                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);\r
2599                         sql_query($query);\r
2600                 }\r
2601                 \r
2602                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2603                 sql_query($query);\r
2604                 \r
2605                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2606                 sql_query($query);\r
2607                 \r
2608                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2609                 sql_query($query);\r
2610                 \r
2611                 // delete all associated plugin options\r
2612                 NucleusPlugin::delete_option_values('member', $memberid);\r
2613                 \r
2614                 $data = array('member' => &$mem);\r
2615                 $manager->notify('PostDeleteMember', $data);\r
2616                 \r
2617                 return '';\r
2618         }\r
2619         \r
2620         /**\r
2621          * Admin::action_createnewlog()\r
2622          * \r
2623          * @param       void\r
2624          * @return      void\r
2625          */\r
2626         static private function action_createnewlog()\r
2627         {\r
2628                 global $member, $CONF, $manager;\r
2629                 \r
2630                 // Only Super-Admins can do this\r
2631                 $member->isAdmin() or self::disallow();\r
2632                 \r
2633                 self::pagehead();\r
2634                 self::$skin->parse('createnewlog');\r
2635                 self::pagefoot();\r
2636                 return;\r
2637         }\r
2638         \r
2639         /**\r
2640          * Admin::action_addnewlog()\r
2641          * \r
2642          * @param       void\r
2643          * @return      void\r
2644          */\r
2645         static private function action_addnewlog()\r
2646         {\r
2647                 global $member, $manager, $CONF;\r
2648                 \r
2649                 // Only Super-Admins can do this\r
2650                 $member->isAdmin() or self::disallow();\r
2651                 \r
2652                 $bname                  = trim(postVar('name'));\r
2653                 $bshortname             = trim(postVar('shortname'));\r
2654                 $btimeoffset    = postVar('timeoffset');\r
2655                 $bdesc                  = trim(postVar('desc'));\r
2656                 $bdefskin               = postVar('defskin');\r
2657                 \r
2658                 if ( !isValidShortName($bshortname) )\r
2659                 {\r
2660                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2661                 }\r
2662                 \r
2663                 if ( $manager->existsBlog($bshortname) )\r
2664                 {\r
2665                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2666                 }\r
2667                 \r
2668                 $data = array(\r
2669                         'name'        => &$bname,\r
2670                         'shortname'   => &$bshortname,\r
2671                         'timeoffset'  => &$btimeoffset,\r
2672                         'description' => &$bdesc,\r
2673                         'defaultskin' => &$bdefskin\r
2674                 );\r
2675                 $manager->notify('PreAddBlog', $data);\r
2676                 \r
2677                 // add slashes for sql queries\r
2678                 $bname                  = sql_real_escape_string($bname);\r
2679                 $bshortname             = sql_real_escape_string($bshortname);\r
2680                 $btimeoffset    = sql_real_escape_string($btimeoffset);\r
2681                 $bdesc                  = sql_real_escape_string($bdesc);\r
2682                 $bdefskin               = sql_real_escape_string($bdefskin);\r
2683                 \r
2684                 // create blog\r
2685                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('%s', '%s', '%s', '%s', '%s');";\r
2686                 $query = sprintf(sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2687                 sql_query($query);\r
2688                 \r
2689                 $blogid =  sql_insert_id();\r
2690                 $blog   =& $manager->getBlog($blogid);\r
2691                 \r
2692                 // create new category\r
2693                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2694                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2695                 \r
2696                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';\r
2697                 sql_query(sprintf($query, sql_table('category'), (integer) $blogid, $catdefname, $catdefdesc));\r
2698                 $catid = sql_insert_id();\r
2699                 \r
2700                 // set as default category\r
2701                 $blog->setDefaultCategory($catid);\r
2702                 $blog->writeSettings();\r
2703                 \r
2704                 // create team member\r
2705                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2706                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2707                 sql_query($query);\r
2708                 \r
2709                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2710                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2711                 \r
2712                 $blog->additem(\r
2713                         $blog->getDefaultCategory(),\r
2714                         $itemdeftitle,$itemdefbody,\r
2715                         '',\r
2716                         $blogid,\r
2717                         $member->getID(),\r
2718                         $blog->getCorrectTime(),\r
2719                         0,\r
2720                         0,\r
2721                         0\r
2722                 );\r
2723                 \r
2724                 $data = array('blog' => &$blog);\r
2725                 $manager->notify('PostAddBlog', $data);\r
2726                 \r
2727                 $data = array(\r
2728                         'blog'                  => &$blog,\r
2729                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2730                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2731                         'catid'                 => $catid\r
2732                 );\r
2733                 $manager->notify('PostAddCategory', $data);\r
2734                 \r
2735                 /* TODO: we should consider to use the other way insterad of this */\r
2736                 $_REQUEST['blogid'] = $blogid;\r
2737                 $_REQUEST['catid']  = $catid;\r
2738                 self::pagehead();\r
2739                 self::$skin->parse('addnewlog');\r
2740                 self::pagefoot();\r
2741                 return;\r
2742         }\r
2743         \r
2744         /**\r
2745          * Admin::action_addnewlog2()\r
2746          * \r
2747          * @param       void\r
2748          * @return      void\r
2749          */\r
2750         static private function action_addnewlog2()\r
2751         {\r
2752                 global $member, $manager;\r
2753                 $blogid = intRequestVar('blogid');\r
2754                 \r
2755                 $member->blogAdminRights($blogid) or self::disallow();\r
2756                 \r
2757                 $burl = requestVar('url');\r
2758                 \r
2759                 $blog =& $manager->getBlog($blogid);\r
2760                 $blog->setURL(trim($burl));\r
2761                 $blog->writeSettings();\r
2762                 \r
2763                 self::$action_overview(_MSG_NEWBLOG);\r
2764                 return;\r
2765         }\r
2766         \r
2767         /**\r
2768          * Admin::action_skinieoverview()\r
2769          * \r
2770          * @param       void\r
2771          * @return      void\r
2772          */\r
2773         static private function action_skinieoverview()\r
2774         {\r
2775                 global $member, $DIR_LIBS, $manager;\r
2776                 \r
2777                 $member->isAdmin() or self::disallow();\r
2778                 \r
2779                 include_once($DIR_LIBS . 'skinie.php');\r
2780                 \r
2781                 self::pagehead();\r
2782                 self::$skin->parse('skinieoverview');\r
2783                 self::pagefoot();\r
2784                 return;\r
2785         }\r
2786         \r
2787         /**\r
2788          * Admin::action_skinieimport()\r
2789          * \r
2790          * @param       void\r
2791          * @return      void\r
2792          */\r
2793         static private function action_skinieimport()\r
2794         {\r
2795                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2796                 \r
2797                 $member->isAdmin() or self::disallow();\r
2798                 \r
2799                 // load skinie class\r
2800                 include_once($DIR_LIBS . 'skinie.php');\r
2801                 \r
2802                 $skinFileRaw    = postVar('skinfile');\r
2803                 $mode                   = postVar('mode');\r
2804                 \r
2805                 $importer = new SkinImport();\r
2806                 \r
2807                 // get full filename\r
2808                 if ($mode == 'file')\r
2809                 {\r
2810                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2811                         \r
2812                         /* TODO: remove this\r
2813                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2814                         if ( !file_exists($skinFile) )\r
2815                         {\r
2816                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2817                         }\r
2818                          */\r
2819                 }\r
2820                 else\r
2821                 {\r
2822                         $skinFile = $skinFileRaw;\r
2823                 }\r
2824                 \r
2825                 // read only metadata\r
2826                 $error = $importer->readFile($skinFile, 1);\r
2827                 \r
2828                 /* TODO: we should consider to use the other way insterad of this */\r
2829                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2830                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2831                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2832                 \r
2833                 // clashes\r
2834                 $skinNameClashe                 = $importer->checkSkinNameClashes();\r
2835                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2836                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2837                 \r
2838                 /* TODO: we should consider to use the other way insterad of this */\r
2839                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2840                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2841                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2842                 \r
2843                 if ( $error )\r
2844                 {\r
2845                         self::error($error);\r
2846                 }\r
2847                 \r
2848                 self::pagehead();\r
2849                 self::$skin->parse('skinieimport');\r
2850                 self::pagefoot();\r
2851                 return;\r
2852         }\r
2853         \r
2854         /**\r
2855          * Admin::action_skiniedoimport()\r
2856          * \r
2857          * @param       void\r
2858          * @return      void\r
2859          */\r
2860         static private function action_skiniedoimport()\r
2861         {\r
2862                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2863                 \r
2864                 $member->isAdmin() or self::disallow();\r
2865                 \r
2866                 // load skinie class\r
2867                 include_once($DIR_LIBS . 'skinie.php');\r
2868                 \r
2869                 $skinFileRaw    = postVar('skinfile');\r
2870                 $mode                   = postVar('mode');\r
2871                 \r
2872                 $allowOverwrite = intPostVar('overwrite');\r
2873                 \r
2874                 // get full filename\r
2875                 if ( $mode == 'file' )\r
2876                 {\r
2877                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2878                         \r
2879                         /* TODO: remove this\r
2880                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2881                         if ( !file_exists($skinFile) )\r
2882                         {\r
2883                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2884                         }\r
2885                         */\r
2886                 }\r
2887                 else\r
2888                 {\r
2889                         $skinFile = $skinFileRaw;\r
2890                 }\r
2891                 \r
2892                 $importer = new SkinImport();\r
2893                 \r
2894                 $error = $importer->readFile($skinFile);\r
2895                 \r
2896                 if ( $error )\r
2897                 {\r
2898                         self::error($error);\r
2899                 }\r
2900                 \r
2901                 $error = $importer->writeToDatabase($allowOverwrite);\r
2902                 \r
2903                 if ( $error )\r
2904                 {\r
2905                         self::error($error);\r
2906                 }\r
2907                 \r
2908                 /* TODO: we should consider to use the other way insterad of this */\r
2909                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2910                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2911                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2912                 \r
2913                 self::pagehead();\r
2914                 self::$skin->parse('skiniedoimport');\r
2915                 self::pagefoot();\r
2916                 return;\r
2917         }\r
2918 \r
2919         /**\r
2920          * Admin::action_skinieexport()\r
2921          * \r
2922          * @param       void\r
2923          * @return      void\r
2924          */\r
2925         static private function action_skinieexport()\r
2926         {\r
2927                 global $member, $DIR_LIBS;\r
2928                 \r
2929                 $member->isAdmin() or self::disallow();\r
2930                 \r
2931                 // load skinie class\r
2932                 include_once($DIR_LIBS . 'skinie.php');\r
2933                 \r
2934                 $aSkins         = requestIntArray('skin');\r
2935                 $aTemplates     = requestIntArray('template');\r
2936                 \r
2937                 if ( !is_array($aTemplates) )\r
2938                 {\r
2939                         $aTemplates = array();\r
2940                 }\r
2941                 if ( !is_array($aSkins) )\r
2942                 {\r
2943                         $aSkins = array();\r
2944                 }\r
2945                 \r
2946                 $skinList               = array_keys($aSkins);\r
2947                 $templateList   = array_keys($aTemplates);\r
2948                 \r
2949                 $info = postVar('info');\r
2950                 \r
2951                 $exporter = new SkinExport();\r
2952                 foreach ( $skinList as $skinId )\r
2953                 {\r
2954                         $exporter->addSkin($skinId);\r
2955                 }\r
2956                 foreach ($templateList as $templateId)\r
2957                 {\r
2958                         $exporter->addTemplate($templateId);\r
2959                 }\r
2960                 $exporter->setInfo($info);\r
2961                 \r
2962                 $exporter->export();\r
2963                 return;\r
2964         }\r
2965         \r
2966         /**\r
2967          * Admin::action_templateoverview()\r
2968          * \r
2969          * @param       void\r
2970          * @return      void\r
2971          */\r
2972         static private function action_templateoverview()\r
2973         {\r
2974                 global $member, $manager;\r
2975                 \r
2976                 $member->isAdmin() or self::disallow();\r
2977                 \r
2978                 self::pagehead();\r
2979                 self::$skin->parse('templateoverview');\r
2980                 self::pagefoot();\r
2981                 return;\r
2982         }\r
2983         \r
2984         /**\r
2985          * Admin::action_templateedit()\r
2986          * \r
2987          * @param       string  $msg    message for pageheader\r
2988          * @return      void\r
2989          */\r
2990         static private function action_templateedit($msg = '')\r
2991         {\r
2992                 global $member, $manager;\r
2993                 if ( $msg )\r
2994                 {\r
2995                         self::$headMess = $msg;\r
2996                 }\r
2997                 \r
2998                 $templateid = intRequestVar('templateid');\r
2999                 \r
3000                 $member->isAdmin() or self::disallow();\r
3001                 \r
3002                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3003                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3004                 \r
3005                 self::pagehead($extrahead);\r
3006                 self::$skin->parse('templateedit');\r
3007                 self::pagefoot();\r
3008                 return;\r
3009         }\r
3010         \r
3011         /**\r
3012          * TODO: remove this\r
3013          *\r
3014         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3015                 static $count = 1;\r
3016                 if (!isset($template[$name])) $template[$name] = '';\r
3017         ?>\r
3018                 </tr><tr>\r
3019                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3020                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3021         <?php       $count++;\r
3022         }\r
3023         */\r
3024         \r
3025         /**\r
3026          * Admin::action_templateupdate()\r
3027          * \r
3028          * @param       void\r
3029          * @return      void\r
3030          */\r
3031         static private function action_templateupdate()\r
3032         {\r
3033                 global $member,$manager;\r
3034                 \r
3035                 $templateid = intRequestVar('templateid');\r
3036                 \r
3037                 $member->isAdmin() or self::disallow();\r
3038                 \r
3039                 $name = postVar('tname');\r
3040                 $desc = postVar('tdesc');\r
3041                 \r
3042                 if ( !isValidTemplateName($name) )\r
3043                 {\r
3044                         self::error(_ERROR_BADTEMPLATENAME);\r
3045                 }\r
3046                 \r
3047                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3048                 {\r
3049                         self::error(_ERROR_DUPTEMPLATENAME);\r
3050                 }\r
3051                 \r
3052                 $name = sql_real_escape_string($name);\r
3053                 $desc = sql_real_escape_string($desc);\r
3054                 \r
3055                 // 1. Remove all template parts\r
3056                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3057                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3058                 sql_query($query);\r
3059                 \r
3060                 // 2. Update description\r
3061                 $query = "UPDATE %s SET tdname='%s',tddesc='%s' WHERE tdnumber=%d;";\r
3062                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3063                 sql_query($query);\r
3064                 \r
3065                 // 3. Add non-empty template parts\r
3066                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3067                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3068                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3069                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3070                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3071                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3072                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3073                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3074                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3075                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3076                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3077                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3078                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3079                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3080                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3081                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3082                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3083                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3084                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3085                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3086                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3087                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3088                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3089                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3090                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3091                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3092                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3093                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3094                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3095                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3096                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3097                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3098                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3099                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3100                 \r
3101                 $data = array('fields' => array());\r
3102                 $manager->notify('TemplateExtraFields', $data);\r
3103                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3104                 {\r
3105                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3106                         {\r
3107                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3108                         }\r
3109                 }\r
3110                 \r
3111                 // jump back to template edit\r
3112                 self::$action_templateedit(_TEMPLATE_UPDATED);\r
3113                 return;\r
3114         }\r
3115         \r
3116         /**\r
3117          * Admin::addToTemplate()\r
3118          * \r
3119          * @param       Integer $id     ID for template\r
3120          * @param       String  $partname       parts name\r
3121          * @param       String  $content        template contents\r
3122          * @return      Integer record index\r
3123          * \r
3124          */\r
3125         static private function addToTemplate($id, $partname, $content)\r
3126         {\r
3127                 // don't add empty parts:\r
3128                 if ( !trim($content) )\r
3129                 {\r
3130                         return -1;\r
3131                 }\r
3132                 \r
3133                 $partname = sql_real_escape_string($partname);\r
3134                 $content  = sql_real_escape_string($content);\r
3135                 \r
3136                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, '%s', '%s');";\r
3137                 $query = sprintf($query, sql_table('template'), (integer) $id, $partname, $content);\r
3138                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3139                 return sql_insert_id();\r
3140         }\r
3141         \r
3142         /**\r
3143          * Admin::action_templatedelete()\r
3144          * \r
3145          * @param       void\r
3146          * @return      void\r
3147          */\r
3148         static private function action_templatedelete()\r
3149         {\r
3150                 global $member, $manager;\r
3151                 \r
3152                 $member->isAdmin() or self::disallow();\r
3153                 \r
3154                 $templateid = intRequestVar('templateid');\r
3155                 // TODO: check if template can be deleted\r
3156                 \r
3157                 self::pagehead();\r
3158                 self::$skin->parse('templatedelete');\r
3159                 self::pagefoot();\r
3160                 return;\r
3161         }\r
3162         \r
3163         /**\r
3164          * Admin::action_templatedeleteconfirm()\r
3165          * \r
3166          * @param       void\r
3167          * @return      void\r
3168          */\r
3169         static private function action_templatedeleteconfirm()\r
3170         {\r
3171                 global $member, $manager;\r
3172                 \r
3173                 $templateid = intRequestVar('templateid');\r
3174                 \r
3175                 $member->isAdmin() or self::disallow();\r
3176                 \r
3177                 $data = array('templateid' => $templateid);\r
3178                 $manager->notify('PreDeleteTemplate', $data);\r
3179                 \r
3180                 // 1. delete description\r
3181                 sql_query('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3182                 \r
3183                 // 2. delete parts\r
3184                 sql_query('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3185                 \r
3186                 \r
3187                 $data = array('templateid' => $templateid);\r
3188                 $manager->notify('PostDeleteTemplate', $data);\r
3189                 \r
3190                 self::$action_templateoverview();\r
3191                 return;\r
3192         }\r
3193         \r
3194         /**\r
3195          * Admin::action_templatenew()\r
3196          * \r
3197          * @param       void\r
3198          * @return      void\r
3199          */\r
3200         static private function action_templatenew()\r
3201         {\r
3202                 global $member;\r
3203                 \r
3204                 $member->isAdmin() or self::disallow();\r
3205                 \r
3206                 $name = postVar('name');\r
3207                 $desc = postVar('desc');\r
3208                 \r
3209                 if ( !isValidTemplateName($name) )\r
3210                 {\r
3211                         self::error(_ERROR_BADTEMPLATENAME);\r
3212                 }\r
3213                 \r
3214                 if ( Template::exists($name) )\r
3215                 {\r
3216                         self::error(_ERROR_DUPTEMPLATENAME);\r
3217                 }\r
3218                 \r
3219                 $newTemplateId = Template::createNew($name, $desc);\r
3220                 \r
3221                 self::$action_templateoverview();\r
3222                 return;\r
3223         }\r
3224         \r
3225         /**\r
3226          * Admin::action_templateclone()\r
3227          * \r
3228          * @param       void\r
3229          * @return      void\r
3230          */\r
3231         static private function action_templateclone()\r
3232         {\r
3233                 global $member;\r
3234                 \r
3235                 $templateid = intRequestVar('templateid');\r
3236                 \r
3237                 $member->isAdmin() or self::disallow();\r
3238                 \r
3239                 // 1. read old template\r
3240                 $name = Template::getNameFromId($templateid);\r
3241                 $desc = Template::getDesc($templateid);\r
3242                 \r
3243                 // 2. create desc thing\r
3244                 $name = "cloned" . $name;\r
3245                 \r
3246                 // if a template with that name already exists:\r
3247                 if ( Template::exists($name) )\r
3248                 {\r
3249                         $i = 1;\r
3250                         while (Template::exists($name . $i))\r
3251                         {\r
3252                                 $i++;\r
3253                         }\r
3254                         $name .= $i;\r
3255                 }\r
3256                 \r
3257                 $newid = Template::createNew($name, $desc);\r
3258                 \r
3259                 // 3. create clone\r
3260                 // go through parts of old template and add them to the new one\r
3261                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3262                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3263                 \r
3264                 $res = sql_query($query);\r
3265                 while ( $o = sql_fetch_object($res) )\r
3266                 {\r
3267                         self::addToTemplate($newid, $o->tpartname, $o->tcontent);\r
3268                 }\r
3269                 \r
3270                 self::$action_templateoverview();\r
3271                 return;\r
3272         }\r
3273         \r
3274         /**\r
3275          * Admin::action_admintemplateoverview()\r
3276          * \r
3277          * @param       void\r
3278          * @return      void\r
3279          */\r
3280         static private function action_admintemplateoverview()\r
3281         {\r
3282                 global $member, $manager;\r
3283                 $member->isAdmin() or self::disallow();\r
3284                 self::pagehead();\r
3285                 self::$skin->parse('admintemplateoverview');\r
3286                 self::pagefoot();\r
3287                 return;\r
3288         }\r
3289         \r
3290         /**\r
3291          * Admin::action_admintemplateedit()\r
3292          * \r
3293          * @param       string  $msg    message for pageheader\r
3294          * @return      void\r
3295          */\r
3296         static private function action_admintemplateedit($msg = '')\r
3297         {\r
3298                 global $member, $manager;\r
3299                 if ( $msg )\r
3300                 {\r
3301                         self::$headMess = $msg;\r
3302                 }\r
3303                 $member->isAdmin() or self::disallow();\r
3304                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3305                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . sql_real_escape_string(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3306                 self::pagehead($extrahead);\r
3307                 self::$skin->parse('admintemplateedit');\r
3308                 self::pagefoot();\r
3309                 return;\r
3310         }\r
3311         \r
3312         /**\r
3313          * Admin::action_admintemplateupdate()\r
3314          * \r
3315          * @param       void\r
3316          * @return      void\r
3317          */\r
3318         static private function action_admintemplateupdate()\r
3319         {\r
3320                 global $member, $manager;\r
3321                 $templateid = intRequestVar('templateid');\r
3322                 $member->isAdmin() or self::disallow();\r
3323                 $name = postVar('tname');\r
3324                 $desc = postVar('tdesc');\r
3325                 \r
3326                 if ( !isValidTemplateName($name) )\r
3327                 {\r
3328                         self::error(_ERROR_BADTEMPLATENAME);\r
3329                 }\r
3330                 \r
3331                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3332                 {\r
3333                         self::error(_ERROR_DUPTEMPLATENAME);\r
3334                 }\r
3335                 $name = sql_real_escape_string($name);\r
3336                 $desc = sql_real_escape_string($desc);\r
3337                 \r
3338                 // 1. Remove all template parts\r
3339                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3340                 $query = sprintf($query, (integer) $templateid);\r
3341                 sql_query($query);\r
3342                 \r
3343                 // 2. Update description\r
3344                 $query = 'UPDATE %s SET tdname=%s tddesc=%s WHERE tdnumber=%d;';\r
3345                 $query = sprintf($query, sql_real_escape_string($name), sql_real_escape_string($desc), (integer) $templateid);\r
3346                 sql_query($query);\r
3347                 \r
3348                 // 3. Add non-empty template parts\r
3349                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3350                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3351                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3352                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3353                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3354                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3355                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3356                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3357                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3358                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3359                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3360                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3361                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3362                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3363                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3364                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3365                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3366                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3367                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3368                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3369                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3370                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3371                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3372                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3373                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3374                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3375                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3376                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3377                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3378                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3379                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3380                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3381                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3382                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3383                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3384                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3385                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3386                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3387                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3388                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3389                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3390                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3391                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3392                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3393                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3394                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3395                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3396                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3397                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3450                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3451                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3452                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3453                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3454                 \r
3455                 $data = array('fields' => array());\r
3456                 $manager->notify('TemplateExtraFields', $data);\r
3457                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3458                 {\r
3459                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3460                         {\r
3461                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3462                         }\r
3463                 }\r
3464                 \r
3465                 // jump back to template edit\r
3466                 self::$action_admintemplateedit(_TEMPLATE_UPDATED);\r
3467                 return;\r
3468         }\r
3469         \r
3470         /**\r
3471          * Admin::addToAdminTemplate()\r
3472          * \r
3473          * @param       integer $id                     ID for template\r
3474          * @param       string  $partname       name of part for template\r
3475          * @param       void    $contents       content for part of template\r
3476          * @return      integer ID for newly inserted Template\r
3477          */\r
3478         static private function addToAdminTemplate($id, $partname, $content)\r
3479         {\r
3480                 // don't add empty parts:\r
3481                 if ( !trim($content) )\r
3482                 {\r
3483                         return -1;\r
3484                 }\r
3485                 \r
3486                 $query = "INSERT INTO (tdesc, tpartname, tcontent ) VALUES (%d, '%s', '%s');";\r
3487                 $query = sprintf($query, sql_table('template'), (integer) $id, sql_real_escape_string($partname), sql_real_escape_string($contents));\r
3488                 sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
3489                 return sql_insert_id();\r
3490         }\r
3491         \r
3492         /**\r
3493          * Admin::action_admintemplatedelete()\r
3494          * \r
3495          * @param       void\r
3496          * @return      void\r
3497          */\r
3498         static private function action_admintemplatedelete()\r
3499         {\r
3500                 global $member, $manager;\r
3501                 $member->isAdmin() or self::disallow();\r
3502                 \r
3503                 // TODO: check if template can be deleted\r
3504                 self::pagehead();\r
3505                 self::$skin->parse('admintemplatedelete');\r
3506                 self::pagefoot();\r
3507                 return;\r
3508         }\r
3509         \r
3510         /**\r
3511          * Admin::action_admintemplatedeleteconfirm()\r
3512          * \r
3513          * @param       void\r
3514          * @return      void\r
3515          */\r
3516         static private function action_admintemplatedeleteconfirm()\r
3517         {\r
3518                 global $member, $manager;\r
3519                 \r
3520                 $templateid = intRequestVar('templateid');\r
3521                 $member->isAdmin() or self::disallow();\r
3522                 \r
3523                 $data = array('templateid' => $templateid);\r
3524                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3525                 \r
3526                 // 1. delete description\r
3527                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3528                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3529                 sql_query($query);\r
3530                 \r
3531                 // 2. delete parts\r
3532                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3533                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3534                 sql_query();\r
3535                 \r
3536                 $data = array('templateid' => $templateid);\r
3537                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3538                 \r
3539                 self::$action_admintemplateoverview();\r
3540                 return;\r
3541         }\r
3542         \r
3543         /**\r
3544          * Admin::action_admintemplatenew()\r
3545          * \r
3546          * @param       void\r
3547          * @return      void\r
3548          */\r
3549         static private function action_admintemplatenew()\r
3550         {\r
3551                 global $member;\r
3552                 $member->isAdmin() or self::disallow();\r
3553                 $name = postVar('name');\r
3554                 $desc = postVar('desc');\r
3555                 \r
3556                 if ( !isValidTemplateName($name) )\r
3557                 {\r
3558                         self::error(_ERROR_BADTEMPLATENAME);\r
3559                 }\r
3560                 if ( Template::exists($name) )\r
3561                 {\r
3562                         self::error(_ERROR_DUPTEMPLATENAME);\r
3563                 }\r
3564                 \r
3565                 $newTemplateId = Template::createNew($name, $desc);\r
3566                 self::$action_admintemplateoverview();\r
3567                 return;\r
3568         }\r
3569         \r
3570         /**\r
3571          * Admin::action_admintemplateclone()\r
3572          * \r
3573          * @param       void\r
3574          * @return      void\r
3575          */\r
3576         static private function action_admintemplateclone()\r
3577         {\r
3578                 global $member;\r
3579                 $templateid = intRequestVar('templateid');\r
3580                 $member->isAdmin() or self::disallow();\r
3581                 \r
3582                 // 1. read old template\r
3583                 $name = Template::getNameFromId($templateid);\r
3584                 $desc = Template::getDesc($templateid);\r
3585                 \r
3586                 // 2. create desc thing\r
3587                 $name = "cloned" . $name;\r
3588                 \r
3589                 // if a template with that name already exists:\r
3590                 if ( Template::exists($name) )\r
3591                 {\r
3592                         $i = 1;\r
3593                         while ( Template::exists($name . $i) )\r
3594                         {\r
3595                                 $i++;\r
3596                         }\r
3597                         $name .= $i;\r
3598                 }\r
3599                 \r
3600                 $newid = Template::admincreateNew($name, $desc);\r
3601                 \r
3602                 // 3. create clone\r
3603                 // go through parts of old template and add them to the new one\r
3604                 $query = "SELECT tpartname, tcontent FROM %sWHERE tdesc=%d;";\r
3605                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3606                 \r
3607                 $res = sql_query($query);\r
3608                 while ( $o = sql_fetch_object($res) )\r
3609                 {\r
3610                         self::addToAdminTemplate($newid, $o->tpartname, $o->tcontent);\r
3611                 }\r
3612                 \r
3613                 self::$action_admintemplateoverview();\r
3614                 return;\r
3615         }\r
3616 \r
3617         /**\r
3618          * Admin::action_skinoverview()\r
3619          * \r
3620          * @param       void\r
3621          * @return      void\r
3622          */\r
3623         static private function action_skinoverview()\r
3624         {\r
3625                 global $member, $manager;\r
3626                 \r
3627                 $member->isAdmin() or self::disallow();\r
3628                 \r
3629                 self::pagehead();\r
3630                 self::$skin->parse('skinoverview');\r
3631                 self::pagefoot();\r
3632                 return;\r
3633         }\r
3634         \r
3635         /**\r
3636          * Admin::action_skinnew()\r
3637          * \r
3638          * @param       void\r
3639          * @return      void\r
3640          */\r
3641         static private function action_skinnew()\r
3642         {\r
3643                 global $member;\r
3644                 \r
3645                 $member->isAdmin() or self::disallow();\r
3646                 \r
3647                 $name = trim(postVar('name'));\r
3648                 $desc = trim(postVar('desc'));\r
3649                 \r
3650                 if ( !isValidSkinName($name) )\r
3651                 {\r
3652                         self::error(_ERROR_BADSKINNAME);\r
3653                 }\r
3654                 \r
3655                 if ( SKIN::exists($name) )\r
3656                 {\r
3657                         self::error(_ERROR_DUPSKINNAME);\r
3658                 }\r
3659                 \r
3660                 $newId = SKIN::createNew($name, $desc);\r
3661                 \r
3662                 self::$action_skinoverview();\r
3663                 return;\r
3664         }\r
3665         \r
3666         /**\r
3667          * Admin::action_skinedit()\r
3668          * \r
3669          * @param       void\r
3670          * @return      void\r
3671          */\r
3672         static private function action_skinedit()\r
3673         {\r
3674                 global $member, $manager;\r
3675                 \r
3676                 $member->isAdmin() or self::disallow();\r
3677                 \r
3678                 self::pagehead();\r
3679                 self::$skin->parse('skinedit');\r
3680                 self::pagefoot();\r
3681                 return;\r
3682         }\r
3683         \r
3684         /**\r
3685          * Admin::action_skineditgeneral()\r
3686          * \r
3687          * @param       void\r
3688          * @return      void\r
3689          */\r
3690         static private function action_skineditgeneral()\r
3691         {\r
3692                 global $member;\r
3693                 \r
3694                 $skinid = intRequestVar('skinid');\r
3695                 \r
3696                 $member->isAdmin() or self::disallow();\r
3697                 \r
3698                 $name           = postVar('name');\r
3699                 $desc           = postVar('desc');\r
3700                 $type           = postVar('type');\r
3701                 $inc_mode       = postVar('inc_mode');\r
3702                 $inc_prefix     = postVar('inc_prefix');\r
3703                 \r
3704                 $skin = new Skin($skinid);\r
3705                 \r
3706                 // 1. Some checks\r
3707                 if ( !isValidSkinName($name) )\r
3708                 {\r
3709                         self::error(_ERROR_BADSKINNAME);\r
3710                 }\r
3711                 \r
3712                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3713                 {\r
3714                         self::error(_ERROR_DUPSKINNAME);\r
3715                 }\r
3716                 \r
3717                 if ( !$type )\r
3718                 {\r
3719                         $type = 'text/html';\r
3720                 }\r
3721                 if ( !$inc_mode )\r
3722                 {\r
3723                         $inc_mode = 'normal';\r
3724                 }\r
3725                 \r
3726                 // 2. Update description\r
3727                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3728                 \r
3729                 self::$action_skinedit();\r
3730                 return;\r
3731         }\r
3732         \r
3733         static private function action_skinedittype($msg = '')\r
3734         {\r
3735                 global $member, $manager;\r
3736                 \r
3737                 $member->isAdmin() or self::disallow();\r
3738                 \r
3739                 if ( $msg )\r
3740                 {\r
3741                         self::$headMess = $msg;\r
3742                 }\r
3743                 \r
3744                 $skinid = intRequestVar('skinid');\r
3745                 $type   = requestVar('type');\r
3746                 $type   = trim($type);\r
3747                 $type   = strtolower($type);\r
3748                 \r
3749                 if ( !isValidShortName($type) )\r
3750                 {\r
3751                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3752                 }\r
3753                 \r
3754                 self::pagehead();\r
3755                 self::$skin->parse('skinedittype');\r
3756                 self::pagefoot();\r
3757                 return;\r
3758         }\r
3759         \r
3760         /**\r
3761          * Admin::action_skinupdate()\r
3762          * \r
3763          * @param       void\r
3764          * @return      void\r
3765          */\r
3766         static private function action_skinupdate()\r
3767         {\r
3768                 global $member;\r
3769                 \r
3770                 $skinid = intRequestVar('skinid');\r
3771                 $content = trim(postVar('content'));\r
3772                 $type = postVar('type');\r
3773                 \r
3774                 $member->isAdmin() or self::disallow();\r
3775                 \r
3776                 $skin = new SKIN($skinid);\r
3777                 $skin->update($type, $content);\r
3778                 \r
3779                 self::$action_skinedittype(_SKIN_UPDATED);\r
3780                 return;\r
3781         }\r
3782         \r
3783         /**\r
3784          * Admin::action_skindelete()\r
3785          * \r
3786          * @param       void\r
3787          * @return      void\r
3788          */\r
3789         static private function action_skindelete()\r
3790         {\r
3791                 global $member, $manager, $CONF;\r
3792                 \r
3793                 $skinid = intRequestVar('skinid');\r
3794                 \r
3795                 $member->isAdmin() or self::disallow();\r
3796                 \r
3797                 // don't allow default skin to be deleted\r
3798                 if ( $skinid == $CONF['BaseSkin'] )\r
3799                 {\r
3800                         self::error(_ERROR_DEFAULTSKIN);\r
3801                 }\r
3802                 \r
3803                 // don't allow deletion of default skins for blogs\r
3804                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3805                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3806                 \r
3807                 $r = sql_query($query);\r
3808                 if ( $o = sql_fetch_object($r) )\r
3809                 {\r
3810                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($o->bname));\r
3811                 }\r
3812                 \r
3813                 self::pagehead();\r
3814                 self::$skin->parse('skindelete');\r
3815                 self::pagefoot();\r
3816                 return;\r
3817         }\r
3818         \r
3819         /**\r
3820          * Admin::action_skindeleteconfirm()\r
3821          * \r
3822          * @param       void\r
3823          * @return      void\r
3824          */\r
3825         static private function action_skindeleteconfirm()\r
3826         {\r
3827                 global $member, $CONF, $manager;\r
3828                 \r
3829                 $skinid = intRequestVar('skinid');\r
3830                 \r
3831                 $member->isAdmin() or self::disallow();\r
3832                 \r
3833                 // don't allow default skin to be deleted\r
3834                 if ( $skinid == $CONF['BaseSkin'] )\r
3835                 {\r
3836                         self::error(_ERROR_DEFAULTSKIN);\r
3837                 }\r
3838                 \r
3839                 // don't allow deletion of default skins for blogs\r
3840                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3841                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3842                 \r
3843                 $r = sql_query($query);\r
3844                 if ( $o = sql_fetch_object($r) )\r
3845                 {\r
3846                         self::error(_ERROR_SKINDEFDELETE .$o->bname);\r
3847                 }\r
3848                 \r
3849                 $data = array('skinid' => $skinid);\r
3850                 $manager->notify('PreDeleteSkin', $data);\r
3851                 \r
3852                 // 1. delete description\r
3853                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3854                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3855                 sql_query($query);\r
3856                 \r
3857                 // 2. delete parts\r
3858                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3859                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3860                 sql_query($query);\r
3861                 \r
3862                 $data = array('skinid' => $skinid);\r
3863                 $manager->notify('PostDeleteSkin', $data);\r
3864                 \r
3865                 self::$action_skinoverview();\r
3866                 return;\r
3867         }\r
3868         \r
3869         /**\r
3870          * Admin::action_skinremovetype()\r
3871          * \r
3872          * @param       void\r
3873          * @return      void\r
3874          */\r
3875         static private function action_skinremovetype()\r
3876         {\r
3877                 global $member, $manager, $CONF;\r
3878                 \r
3879                 $member->isAdmin() or self::disallow();\r
3880                 \r
3881                 $skinid = intRequestVar('skinid');\r
3882                 $skintype = requestVar('type');\r
3883                 \r
3884                 if ( !isValidShortName($skintype) )\r
3885                 {\r
3886                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3887                 }\r
3888                 \r
3889                 // don't allow default skinparts to be deleted\r
3890                 /* TODO: this array should be retrieved from Action class */\r
3891                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3892                 {\r
3893                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3894                 }\r
3895                 \r
3896                 self::pagehead();\r
3897                 self::$skin->parse('skinremovetype');\r
3898                 self::pagefoot();\r
3899                 return;\r
3900         }\r
3901         \r
3902         /**\r
3903          * Admin::action_skinremovetypeconfirm()\r
3904          * \r
3905          * @param       void\r
3906          * @return      void\r
3907          */\r
3908         static private function action_skinremovetypeconfirm()\r
3909         {\r
3910                 global $member, $CONF, $manager;\r
3911                 \r
3912                 $member->isAdmin() or self::disallow();\r
3913                 \r
3914                 $skinid = intRequestVar('skinid');\r
3915                 $skintype = requestVar('type');\r
3916                 \r
3917                 if ( !isValidShortName($skintype) )\r
3918                 {\r
3919                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3920                 }\r
3921                 \r
3922                 // don't allow default skinparts to be deleted\r
3923                 /* TODO: this array should be retrieved from Action class */\r
3924                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3925                 {\r
3926                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3927                 }\r
3928                 \r
3929                 $data = array(\r
3930                         'skinid'   => $skinid,\r
3931                         'skintype' => $skintype\r
3932                 );\r
3933                 $manager->notify('PreDeleteSkinPart', $data);\r
3934                 \r
3935                 // delete part\r
3936                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3937                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3938                 sql_query($query);\r
3939                 \r
3940                 $data = array(\r
3941                         'skinid'   => $skinid,\r
3942                         'skintype' => $skintype\r
3943                 );\r
3944                 $manager->notify('PostDeleteSkinPart', $data);\r
3945                 \r
3946                 self::$action_skinedit();\r
3947                 return;\r
3948         }\r
3949 \r
3950         /**\r
3951          * Admin::action_skinclone()\r
3952          * \r
3953          * @param       void\r
3954          * @return      void\r
3955          */\r
3956         static private function action_skinclone()\r
3957         {\r
3958                 global $member;\r
3959                 \r
3960                 $member->isAdmin() or self::disallow();\r
3961                 \r
3962                 $skinid = intRequestVar('skinid');\r
3963                 \r
3964                 // 1. read skin to clone\r
3965                 $skin = new Skin($skinid);\r
3966                 \r
3967                 $name = "clone_{$skin->getName()}";\r
3968                 \r
3969                 // if a skin with that name already exists:\r
3970                 if ( Skin::exists($name) )\r
3971                 {\r
3972                         $i = 1;\r
3973                         while (Skin::exists($name . $i))\r
3974                                 $i++;\r
3975                         $name .= $i;\r
3976                 }\r
3977                 \r
3978                 // 2. create skin desc\r
3979                 $newid = Skin::createNew(\r
3980                         $name,\r
3981                         $skin->getDescription(),\r
3982                         $skin->getContentType(),\r
3983                         $skin->getIncludeMode(),\r
3984                         $skin->getIncludePrefix()\r
3985                 );\r
3986                 \r
3987                 // 3. clone\r
3988                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
3989                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3990                 \r
3991                 $res = sql_query($query);\r
3992                 while ( $row = sql_fetch_assoc($res) )\r
3993                 {\r
3994                         self::$skinclonetype($skin, $newid, $row['stype']);\r
3995                 }\r
3996                 \r
3997                 self::$action_skinoverview();\r
3998                 return;\r
3999         }\r
4000         \r
4001         /**\r
4002          * Admin::skinclonetype()\r
4003          * \r
4004          * @param       String  $skin   Skin object\r
4005          * @param       Integer $newid  ID for this clone\r
4006          * @param       String  $type   type of skin\r
4007          * @return      Void\r
4008          */\r
4009         static private function skinclonetype($skin, $newid, $type)\r
4010         {\r
4011                 $newid = intval($newid);\r
4012                 $content = $skin->getContent($type);\r
4013                 \r
4014                 if ( $content )\r
4015                 {\r
4016                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4017                         $query = sprintf($query, sql_table('skin'), (integer) $newid, $content, $type);\r
4018                         sql_query($query);\r
4019                 }\r
4020                 return;\r
4021         }\r
4022         \r
4023         /**\r
4024          * Admin::action_adminskinoverview()\r
4025          * \r
4026          * @param       void\r
4027          * @return      void\r
4028          */\r
4029         static private function action_adminskinoverview()\r
4030         {\r
4031                 global $member, $manager;\r
4032                 \r
4033                 $member->isAdmin() or self::disallow();\r
4034                 \r
4035                 self::pagehead();\r
4036                 self::$skin->parse('adminskinoverview');\r
4037                 self::pagefoot();\r
4038                 return;\r
4039         }\r
4040         \r
4041         /**\r
4042          * Admin::action_adminskinnew()\r
4043          * \r
4044          * @param       void\r
4045          * @return      void\r
4046          */\r
4047         static private function action_adminskinnew()\r
4048         {\r
4049                 global $member;\r
4050                 $member->isAdmin() or self::disallow();\r
4051                 $name = trim(postVar('name'));\r
4052                 $desc = trim(postVar('desc'));\r
4053                 \r
4054                 if ( !isValidSkinName($name) )\r
4055                 {\r
4056                         self::error(_ERROR_BADSKINNAME);\r
4057                 }\r
4058                 if ( Skin::exists($name) )\r
4059                 {\r
4060                         self::error(_ERROR_DUPSKINNAME);\r
4061                 }\r
4062                 /* TODO: $newId is not reused... */\r
4063                 $newId = Skin::createNew($name, $desc);\r
4064                 self::$action_adminskinoverview();\r
4065                 return;\r
4066         }\r
4067         \r
4068         /**\r
4069          * Admin::action_adminskinedit()\r
4070          * \r
4071          * @param       void\r
4072          * @return      void\r
4073          */\r
4074         static private function action_adminskinedit()\r
4075         {\r
4076                 global $member, $manager;\r
4077                 \r
4078                 $member->isAdmin() or self::disallow();\r
4079                 self::pagehead();\r
4080                 self::$skin->parse('adminskinedit');\r
4081                 self::pagefoot();\r
4082                 return;\r
4083         }\r
4084         \r
4085         /**\r
4086          * Admin::action_adminskineditgeneral()\r
4087          * \r
4088          * @param       void\r
4089          * @return      void\r
4090          */\r
4091         static private function action_adminskineditgeneral()\r
4092         {\r
4093                 global $member;\r
4094                 \r
4095                 $skinid = intRequestVar('skinid');\r
4096                 \r
4097                 $member->isAdmin() or self::disallow();\r
4098                 \r
4099                 $name           = postVar('name');\r
4100                 $desc           = postVar('desc');\r
4101                 $type           = postVar('type');\r
4102                 $inc_mode       = postVar('inc_mode');\r
4103                 $inc_prefix     = postVar('inc_prefix');\r
4104                 \r
4105                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4106                 \r
4107                 // 1. Some checks\r
4108                 if ( !isValidSkinName($name) )\r
4109                 {\r
4110                         self::error(_ERROR_BADSKINNAME);\r
4111                 }\r
4112                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4113                 {\r
4114                         self::error(_ERROR_DUPSKINNAME);\r
4115                 }\r
4116                 if ( !$type )\r
4117                 {\r
4118                         $type = 'text/html';\r
4119                 }\r
4120                 if ( !$inc_mode )\r
4121                 {\r
4122                         $inc_mode = 'normal';\r
4123                 }\r
4124                 // 2. Update description\r
4125                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4126                 self::$action_adminskinedit();\r
4127                 return;\r
4128         }\r
4129         \r
4130         /**\r
4131          * Admin::action_adminskinedittype()\r
4132          * \r
4133          * @param       string  $msg    message for pageheader\r
4134          * @return      void\r
4135          */\r
4136         static private function action_adminskinedittype($msg = '')\r
4137         {\r
4138                 global $member, $manager;\r
4139                 \r
4140                 $member->isAdmin() or self::disallow();\r
4141                 \r
4142                 if ( $msg )\r
4143                 {\r
4144                         self::$headMess = $msg;\r
4145                 }\r
4146                 $type = requestVar('type');\r
4147                 $type = trim($type);\r
4148                 $type = strtolower($type);\r
4149                 \r
4150                 if ( !isValidShortName($type) )\r
4151                 {\r
4152                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4153                 }\r
4154                 \r
4155                 self::pagehead();\r
4156                 self::$skin->parse('adminskinedittype');\r
4157                 self::pagefoot();\r
4158                 return;\r
4159         }\r
4160         \r
4161         /**\r
4162          * Admin::action_adminskinupdate()\r
4163          * \r
4164          * @param       void\r
4165          * @return      void\r
4166          */\r
4167         static private function action_adminskinupdate()\r
4168         {\r
4169                 global $member;\r
4170                 $skinid         = intRequestVar('skinid');\r
4171                 $content        = trim(postVar('content'));\r
4172                 $type           = postVar('type');\r
4173                 \r
4174                 $member->isAdmin() or self::disallow();\r
4175                 \r
4176                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4177                 $skin->update($type, $content);\r
4178                 self::$action_adminskinedittype(_SKIN_UPDATED);\r
4179                 return;\r
4180         }\r
4181         \r
4182         /**\r
4183          * Admin::action_adminskindelete()\r
4184          * \r
4185          * @param       void\r
4186          * @return      void\r
4187          */\r
4188         static private function action_adminskindelete()\r
4189         {\r
4190                 global $member, $manager, $CONF;\r
4191                 $member->isAdmin() or self::disallow();\r
4192                 \r
4193                 /* TODO: needless variable $skinid... */\r
4194                 $skinid = intRequestVar('skinid');\r
4195                 self::pagehead();\r
4196                 self::$skin->parse('adminskindelete');\r
4197                 self::pagefoot();\r
4198                 return;\r
4199         }\r
4200 \r
4201         /**\r
4202          * Admin::action_adminskindeleteconfirm()\r
4203          * \r
4204          * @param       void\r
4205          * @return      void\r
4206          */\r
4207         static private function action_adminskindeleteconfirm()\r
4208         {\r
4209                 global $member, $CONF, $manager;\r
4210                 $member->isAdmin() or self::disallow();\r
4211                 $skinid = intRequestVar('skinid');\r
4212                 // don't allow default skin to be deleted\r
4213                 if ( $skinid == $CONF['DefaultAdminSkin'] )\r
4214                 {\r
4215                         self::error(_ERROR_DEFAULTSKIN);\r
4216                 }\r
4217                 \r
4218                 // don't allow deletion of default skins for members\r
4219                 $memberDefaults =  $member->getAdminSkin();\r
4220                 foreach ( $memberDefaults as $memID => $adminskin )\r
4221                 {\r
4222                         if ( $skinid == $adminskin )\r
4223                         {\r
4224                                 $mem = MEMBER::createFromID($memID);\r
4225                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4226                         }\r
4227                 }\r
4228                 \r
4229                 $data = array('skinid' => (integer) $skinid);\r
4230                 $manager->notify('PreDeleteAdminSkin', $data);\r
4231                 \r
4232                 // 1. delete description\r
4233                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
4234                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
4235                 sql_query($query);\r
4236                 \r
4237                 // 2. delete parts\r
4238                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
4239                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
4240                 \r
4241                 sql_query($query);\r
4242                 \r
4243                 $data = array('skinid' => intval($skinid));\r
4244                 $manager->notify('PostDeleteAdminSkin', $data);\r
4245                 self::$action_adminskinoverview();\r
4246                 return;\r
4247         }\r
4248         \r
4249         /**\r
4250          * Admin::action_adminskinremovetype()\r
4251          * \r
4252          * @param       void\r
4253          * @return      void\r
4254          */\r
4255         static private function action_adminskinremovetype()\r
4256         {\r
4257                 global $member, $manager, $CONF;\r
4258 \r
4259                 $member->isAdmin() or self::disallow();\r
4260                 \r
4261                 $skinid         = intRequestVar('skinid');\r
4262                 $skintype       = requestVar('type');\r
4263                 \r
4264                 if ( !isValidShortName($skintype) )\r
4265                 {\r
4266                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4267                 }\r
4268                 \r
4269                 self::pagehead();\r
4270                 self::$skin->parse('adminskinremovetype');\r
4271                 self::pagefoot();\r
4272                 return;\r
4273         }\r
4274         \r
4275         /**\r
4276          * Admin::action_adminskinremovetypeconfirm()\r
4277          * \r
4278          * @param       void\r
4279          * @return      void\r
4280          */\r
4281         static private function action_adminskinremovetypeconfirm()\r
4282         {\r
4283                 global $member, $CONF, $manager;\r
4284                 \r
4285                 $member->isAdmin() or self::disallow();\r
4286                 \r
4287                 $skinid         = intRequestVar('skinid');\r
4288                 $skintype       = requestVar('type');\r
4289                 \r
4290                 if ( !isValidShortName($skintype) )\r
4291                 {\r
4292                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4293                 }\r
4294                 \r
4295                 $data =array(\r
4296                         'skinid'        => $skinid,\r
4297                         'skintype'      => $skintype\r
4298                 );\r
4299                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4300                 \r
4301                 // delete part\r
4302                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4303                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4304                 sql_query($query);\r
4305                 \r
4306                 $data = array(\r
4307                         'skinid'        => $skinid,\r
4308                         'skintype'      => $skintype\r
4309                 );\r
4310                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4311                 \r
4312                 self::$action_adminskinedit();\r
4313                 return;\r
4314         }\r
4315 \r
4316         /**\r
4317          * Admin::action_adminskinclone()\r
4318          * \r
4319          * @param       void\r
4320          * @return      void\r
4321          */\r
4322         static private function action_adminskinclone()\r
4323         {\r
4324                 global $member;\r
4325                 \r
4326                 $member->isAdmin() or self::disallow();\r
4327                 \r
4328                 $skinid = intRequestVar('skinid');\r
4329                 \r
4330                 // 1. read skin to clone\r
4331                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4332                 $name = "clone_{$skin->getName()}";\r
4333                 \r
4334                 // if a skin with that name already exists:\r
4335                 if ( Skin::exists($name) )\r
4336                 {\r
4337                         $i = 1;\r
4338                         while ( Skin::exists($name . $i) )\r
4339                         {\r
4340                                 $i++;\r
4341                         }\r
4342                         $name .= $i;\r
4343                 }\r
4344                 \r
4345                 // 2. create skin desc\r
4346                 $newid = Skin::createNew(\r
4347                         $name,\r
4348                         $skin->getDescription(),\r
4349                         $skin->getContentType(),\r
4350                         $skin->getIncludeMode(),\r
4351                         $skin->getIncludePrefix()\r
4352                 );\r
4353                 \r
4354                 $query = "SELECT stype %s FROM WHERE sdesc=%d;";\r
4355                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4356                 \r
4357                 $res = sql_query($query);\r
4358                 while ( $row = sql_fetch_assoc($res) )\r
4359                 {\r
4360                         self::$skinclonetype($skin, $newid, $row['stype']);\r
4361                 }\r
4362                 self::$action_adminskinoverview();\r
4363                 return;\r
4364         }\r
4365         \r
4366         /**\r
4367          * Admin::adminskinclonetype()\r
4368          * \r
4369          * @param       string  $skin   an instance of Skin class\r
4370          * @param       integer $newid  ID for new skin\r
4371          * @param       string  $type   skin type\r
4372          * @return      void\r
4373          */\r
4374         static private function adminskinclonetype($skin, $newid, $type)\r
4375         {\r
4376                 $content = $skin->getContent($type);\r
4377                 \r
4378                 if ( $content )\r
4379                 {\r
4380                         $content        = sql_real_escape_string($content);\r
4381                         $type           = sql_real_escape_string($type);\r
4382                         \r
4383                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, '%s', '%s')";\r
4384                         $query = sprintf(sql_table('skin'), (integer) $newid, $content, $type);\r
4385                         sql_query($query);\r
4386                 }\r
4387                 return;\r
4388         }\r
4389         \r
4390         /**\r
4391          * Admin::action_adminskinieoverview()\r
4392          * \r
4393          * @param       void\r
4394          * @return      void\r
4395          */\r
4396         static private function action_adminskinieoverview()\r
4397         {\r
4398                 global $member, $DIR_LIBS, $manager;\r
4399                 \r
4400                 $member->isAdmin() or self::disallow();\r
4401                 \r
4402                 // load skinie class\r
4403                 include_once($DIR_LIBS . 'skinie.php');\r
4404                 \r
4405                 self::pagehead();\r
4406                 self::$skin->parse('adminskinieoverview');\r
4407                 self::pagefoot();\r
4408                 return;\r
4409         }\r
4410 \r
4411         /**\r
4412          * Admin::action_adminskinieimport()\r
4413          * \r
4414          * @param       void\r
4415          * @return      void\r
4416          */\r
4417         static private function action_adminskinieimport()\r
4418         {\r
4419                 global $DIR_LIBS, $DIR_ADMINSKINS, $manager, $member;\r
4420                 \r
4421                 $member->isAdmin() or self::disallow();\r
4422                 \r
4423                 // load skinie class\r
4424                 include_once($DIR_LIBS . 'skinie.php');\r
4425                 \r
4426                 $skinFileRaw    = postVar('skinfile');\r
4427                 $mode                   = postVar('mode');\r
4428                 \r
4429                 $importer = new SKINIMPORT();\r
4430                 \r
4431                 // get full filename\r
4432                 if ( $mode == 'file' )\r
4433                 {\r
4434                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4435                         \r
4436                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4437                         if ( !file_exists($skinFile) )\r
4438                         {\r
4439                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4440                         }\r
4441                 }\r
4442                 else\r
4443                 {\r
4444                         $skinFile = $skinFileRaw;\r
4445                 }\r
4446                 \r
4447                 // read only metadata\r
4448                 $error = $importer->readFile($skinFile, 1);\r
4449                 if ( $error )\r
4450                 {\r
4451                         self::error($error);\r
4452                 }\r
4453                 \r
4454                 /* TODO: we should consider to use the other way instead of this */\r
4455                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4456                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4457                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4458                 \r
4459                 // clashes\r
4460                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4461                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4462                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4463                 /* TODO: we should consider to use the other way instead of this */\r
4464                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4465                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4466                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4467                 \r
4468                 self::pagehead();\r
4469                 self::$skin->parse('adminskinieimport');\r
4470                 self::pagefoot();\r
4471                 return;\r
4472         }\r
4473         \r
4474         /**\r
4475          * Admin::action_adminskiniedoimport()\r
4476          * \r
4477          * @param       void\r
4478          * @return      void\r
4479          */\r
4480         static private function action_adminskiniedoimport()\r
4481         {\r
4482                 global $DIR_LIBS, $DIR_ADMINSKINS, $member;\r
4483                 \r
4484                 $member->isAdmin() or self::disallow();\r
4485                 \r
4486                 // load skinie class\r
4487                 include_once($DIR_LIBS . 'skinie.php');\r
4488                 \r
4489                 $skinFileRaw    = postVar('skinfile');\r
4490                 $mode                   = postVar('mode');\r
4491                 $allowOverwrite = intPostVar('overwrite');\r
4492                 \r
4493                 // get full filename\r
4494                 if ( $mode == 'file' )\r
4495                 {\r
4496                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
4497                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4498                         if ( !file_exists($skinFile) )\r
4499                         {\r
4500                                 $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skindata.xml';\r
4501                         }\r
4502                 }\r
4503                 else\r
4504                 {\r
4505                         $skinFile = $skinFileRaw;\r
4506                 }\r
4507                 \r
4508                 $importer = new SKINIMPORT();\r
4509                 \r
4510                 $error = $importer->readFile($skinFile);\r
4511                 if ( $error )\r
4512                 {\r
4513                         self::error($error);\r
4514                 }\r
4515                 \r
4516                 $error = $importer->writeToDatabase($allowOverwrite);\r
4517                 if ( $error )\r
4518                 {\r
4519                         self::error($error);\r
4520                 }\r
4521                 \r
4522                 /* TODO: we should consider to use the other way instead of this */\r
4523                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4524                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4525                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4526                 \r
4527                 self::pagehead();\r
4528                 self::$skin->parse('adminskiniedoimport');\r
4529                 self::pagefoot();\r
4530                 return;\r
4531         }\r
4532 \r
4533         /**\r
4534          * Admin::action_adminskinieexport()\r
4535          * \r
4536          * @param       void\r
4537          * @return      void\r
4538          */\r
4539         static private function action_adminskinieexport()\r
4540         {\r
4541                 global $member, $DIR_PLUGINS;\r
4542                 \r
4543                 $member->isAdmin() or self::disallow();\r
4544                 \r
4545                 // load skinie class\r
4546                 $aSkins = requestIntArray('skin');\r
4547                 if (!is_array($aSkins)) {\r
4548                         $aSkins = array();\r
4549                 }\r
4550                 $skinList = array_keys($aSkins);\r
4551                 \r
4552                 $aTemplates = requestIntArray('template');\r
4553                 if (!is_array($aTemplates))\r
4554                 {\r
4555                         $aTemplates = array();\r
4556                 }\r
4557                 $templateList = array_keys($aTemplates);\r
4558                 \r
4559                 $info = postVar('info');\r
4560                 \r
4561                 $exporter = new SkinEXPORT();\r
4562                 foreach ( $skinList as $skinId )\r
4563                 {\r
4564                         $exporter->addSkin($skinId);\r
4565                 }\r
4566                 foreach ( $templateList as $templateId )\r
4567                 {\r
4568                         $exporter->addTemplate($templateId);\r
4569                 }\r
4570                 $exporter->setInfo($info);\r
4571                 $exporter->export();\r
4572                 return;\r
4573         }\r
4574         \r
4575         /**\r
4576          * Admin::action_settingsedit()\r
4577          * \r
4578          * @param       Void\r
4579          * @return      Void\r
4580          */\r
4581         static private function action_settingsedit()\r
4582         {\r
4583                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4584                 \r
4585                 $member->isAdmin() or self::disallow();\r
4586                 \r
4587                 self::pagehead();\r
4588                 self::$skin->parse('settingsedit');\r
4589                 self::pagefoot();\r
4590                 return;\r
4591         }\r
4592         \r
4593         /**\r
4594          * Admin::action_settingsupdate()\r
4595          * Update $CONFIG and redirect\r
4596          * \r
4597          * @param       void\r
4598          * @return      void\r
4599          */\r
4600         static private function action_settingsupdate()\r
4601         {\r
4602                 global $member, $CONF;\r
4603                 \r
4604                 $member->isAdmin() or self::disallow();\r
4605                 \r
4606                 // check if email address for admin is valid\r
4607                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4608                 {\r
4609                         self::error(_ERROR_BADMAILADDRESS);\r
4610                 }\r
4611                 \r
4612                 // save settings\r
4613                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4614                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4615                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4616                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4617                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4618                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4619                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4620                 self::updateConfig('Locale',                    postVar('Locale'));\r
4621                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4622                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4623                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4624                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4625                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4626                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4627                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4628                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4629                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4630                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4631                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4632                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4633                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4634                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4635                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4636                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4637                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4638                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4639                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4640                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4641                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4642                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4643                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4644                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4645                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4646                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4647                 \r
4648                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4649                 // note that when changing cookie settings, this redirect might cause the user\r
4650                 // to have to log in again.\r
4651                 getConfig();\r
4652                 redirect($CONF['AdminURL'] . '?action=manage');\r
4653                 return;\r
4654         }\r
4655         \r
4656         /**\r
4657          * Admin::action_systemoverview()\r
4658          * Output system overview\r
4659          * \r
4660          * @param       void\r
4661          * @return      void\r
4662          */\r
4663         static private function action_systemoverview()\r
4664         {\r
4665                 self::pagehead();\r
4666                 self::$skin->parse('systemoverview');\r
4667                 self::pagefoot();\r
4668                 return;\r
4669         }\r
4670         \r
4671         /**\r
4672          * Admin::updateConfig()\r
4673          * \r
4674          * @param       string  $name   \r
4675          * @param       string  $val    \r
4676          * @return      integer return the ID in which the latest query posted\r
4677          */\r
4678         static private function updateConfig($name, $val)\r
4679         {\r
4680                 $name = sql_real_escape_string($name);\r
4681                 $val = trim(sql_real_escape_string($val));\r
4682                 \r
4683                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";\r
4684                 $query = sprintf($query, sql_table('config'), $val, $name);\r
4685                 sql_query($query) or die(_ADMIN_SQLDIE_QUERYERROR . sql_error());\r
4686                 return sql_insert_id();\r
4687         }\r
4688         \r
4689         /**\r
4690          * Admin::error()\r
4691          * Error message\r
4692          * \r
4693          * @param       string  $msg    message that will be shown\r
4694          * @return      void\r
4695          */\r
4696         static private function error($msg)\r
4697         {\r
4698                 self::pagehead();\r
4699                 self::$skin->parse('adminerrorpage');\r
4700                 self::pagefoot();\r
4701                 return;\r
4702         }\r
4703         \r
4704         /**\r
4705          * Admin::disallow()\r
4706          * add error log and show error page \r
4707          * \r
4708          * @param       void\r
4709          * @return      void\r
4710          */\r
4711         static private function disallow()\r
4712         {\r
4713                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4714                 self::error(_ERROR_DISALLOWED);\r
4715                 return;\r
4716         }\r
4717         \r
4718         /**\r
4719          * Admin::pagehead()\r
4720          * Output admin page head\r
4721          * \r
4722          * @param       void\r
4723          * @return      void\r
4724          */\r
4725         static private function pagehead($extrahead = '')\r
4726         {\r
4727                 global $member, $nucleus, $CONF, $manager;\r
4728 \r
4729                 if ( self::existsSkinContents('pagehead') )\r
4730                 {\r
4731                         if ( isset($extrahead) && !empty($extrahead) )\r
4732                         {\r
4733                         self::$extrahead = $extrahead;\r
4734                         }\r
4735                         self::$skin->parse('pagehead');\r
4736                 }\r
4737                 else\r
4738                 {\r
4739                         $data = array(\r
4740                                 'extrahead'     => &$extrahead,\r
4741                                 'action'        => self::$action\r
4742                         );\r
4743                         \r
4744                         $manager->notify('AdminPrePageHead', $data);\r
4745                         \r
4746                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4747                         \r
4748                         /*\r
4749                          * TODO: obsoleted\r
4750                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4751                         {\r
4752                                 sql_query("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4753                                 $CONF['AdminCSS'] = 'original';\r
4754                         }\r
4755                         */\r
4756                         \r
4757                         /* HTTP 1.1 application for no caching */\r
4758                         header("Cache-Control: no-cache, must-revalidate");\r
4759                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4760                         \r
4761                         $root_element = 'html';\r
4762                         $charset = i18n::get_current_charset();\r
4763                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4764                         $xml_version_info = self::$xml_version_info;\r
4765                         $formal_public_identifier = self::$formal_public_identifier;\r
4766                         $system_identifier = self::$system_identifier;\r
4767                         $xhtml_namespace = self::$xhtml_namespace;\r
4768                         \r
4769                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4770                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4771                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4772                         echo "<head>\n";\r
4773                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4774                         /*\r
4775                          * TODO: obsoleted\r
4776                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4777                         */\r
4778                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4779                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";\r
4780                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";\r
4781                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";\r
4782                         echo "{$extrahead}\n";\r
4783                         echo "</head>\n\n";\r
4784                         echo "<body>\n";\r
4785                         echo "<div id=\"adminwrapper\">\n";\r
4786                         echo "<div class=\"header\">\n";\r
4787                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4788                         echo "</div>\n";\r
4789                         echo "<div id=\"container\">\n";\r
4790                         echo "<div id=\"content\">\n";\r
4791                         echo "<div class=\"loginname\">\n";\r
4792                         if ( $member->isLoggedIn() )\r
4793                         {\r
4794                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4795                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4796                         }\r
4797                         else\r
4798                         {\r
4799                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4800                         }\r
4801                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4802                         echo '(';\r
4803                         \r
4804                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4805                         {\r
4806                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4807                         }\r
4808                         else\r
4809                         {\r
4810                                 $codenamestring = '';\r
4811                         }\r
4812                         \r
4813                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4814                         {\r
4815                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4816                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4817                                 \r
4818                                 $newestVersion = getLatestVersion();\r
4819                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4820                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4821                                 \r
4822                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4823                                 {\r
4824                                         echo "<br />\n";\r
4825                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4826                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4827                                         echo "</a>";\r
4828                                 }\r
4829                         }\r
4830                         else\r
4831                         {\r
4832                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4833                         }\r
4834                         echo ')';\r
4835                         echo '</div>';\r
4836                 }\r
4837                 return;\r
4838         }\r
4839         \r
4840         /**\r
4841          * Admin::pagefoot()\r
4842          * Output admin page foot include quickmenu\r
4843          * \r
4844          * @param       void\r
4845          * @return      void\r
4846          */\r
4847         static private function pagefoot()\r
4848         {\r
4849                 global $action, $member, $manager;\r
4850                 \r
4851                 if ( self::existsSkinContents('pagefoot') )\r
4852                 {\r
4853                         self::$skin->parse('pagefoot');\r
4854                         exit;\r
4855                 }\r
4856                 else\r
4857                 {\r
4858                         $data = array(\r
4859                                 'action' => self::$action\r
4860                         );\r
4861                         \r
4862                         $manager->notify('AdminPrePageFoot', $data);\r
4863                         \r
4864                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
4865                         {\r
4866                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
4867                                 echo "<ul>\n";\r
4868                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
4869                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
4870                                 echo "</ul>\n";\r
4871                         }\r
4872                         \r
4873                         echo "<div class=\"foot\">\n";\r
4874                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
4875                         echo '-';\r
4876                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
4877                         echo "</div>\n";\r
4878                         \r
4879                         echo "<div id=\"quickmenu\">\n";\r
4880                         \r
4881                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
4882                         {\r
4883                                 echo "<ul>\n";\r
4884                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
4885                                 echo "</ul>\n";\r
4886                                 \r
4887                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
4888                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
4889                                 echo "<p>\n";\r
4890                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
4891                                 \r
4892                                 $showAll = requestVar('showall');\r
4893                                 \r
4894                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
4895                                 {\r
4896                                         // Super-Admins have access to all blogs! (no add item support though)\r
4897                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
4898                                         $query = sprintf($query, sql_table('blog'));\r
4899                                 }\r
4900                                 else\r
4901                                 {\r
4902                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
4903                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
4904                                 }\r
4905                                 $template['name']               = 'blogid';\r
4906                                 $template['tabindex']   = 15000;\r
4907                                 $template['extra']              = _QMENU_ADD_SELECT;\r
4908                                 $template['selected']   = -1;\r
4909                                 $template['shorten']    = 10;\r
4910                                 $template['shortenel']  = '';\r
4911                                 $template['javascript'] = 'onchange="return form.submit()"';\r
4912                                 showlist($query, 'select', $template);\r
4913                                 \r
4914                                 echo "</p>\n";\r
4915                                 echo "</form>\n";\r
4916                                 \r
4917                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
4918                                 echo "<ul>\n";\r
4919                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
4920                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
4921                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
4922                                 echo "</ul>\n";\r
4923                                 \r
4924                                 if ( $member->isAdmin() )\r
4925                                 {\r
4926                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
4927                                         echo "<ul>\n";\r
4928                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
4929                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
4930                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
4931                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
4932                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
4933                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
4934                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
4935                                         echo "</ul>\n";\r
4936                                         \r
4937                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
4938                                         echo "<ul>\n";\r
4939                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
4940                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
4941                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
4942                                         echo "</ul>\n";\r
4943                                 }\r
4944                                 \r
4945                                 $data = array('options' => array());\r
4946                                 \r
4947                                 $manager->notify('QuickMenu', $data);\r
4948                                 \r
4949                                 if ( count($data['options']) > 0 )\r
4950                                 {\r
4951                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
4952                                         echo "<ul>\n";\r
4953                                         foreach ( $data['options'] as $option )\r
4954                                         {\r
4955                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
4956                                         }\r
4957                                         echo "</ul>\n";\r
4958                                 }\r
4959                         }\r
4960                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
4961                         {\r
4962                         \r
4963                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
4964                         }\r
4965                         else\r
4966                         {\r
4967                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
4968                         }\r
4969                         \r
4970                         echo "<!-- quickmenu -->\n";\r
4971                         echo "</div>\n";\r
4972                         \r
4973                         echo "<!-- content -->\n";\r
4974                         echo "</div>\n";\r
4975                         \r
4976                         echo "<!-- container -->\n";\r
4977                         echo "</div>\n";\r
4978                         \r
4979                         echo "<!-- adminwrapper -->\n";\r
4980                         echo "</div>\n";\r
4981                         \r
4982                         echo "</body>\n";\r
4983                         echo "</html>\n";\r
4984                 }\r
4985                 return;\r
4986         }\r
4987         \r
4988         /**\r
4989          * Admin::action_bookmarklet()\r
4990          * \r
4991          * @param       void\r
4992          * @return      void\r
4993          */\r
4994         static private function action_bookmarklet()\r
4995         {\r
4996                 global $member, $manager;\r
4997                 \r
4998                 $member->teamRights($blogid) or self::disallow();\r
4999                 \r
5000                 $blogid = intRequestVar('blogid');\r
5001                 \r
5002                 self::pagehead();\r
5003                 self::$skin->parse('bookmarklet');\r
5004                 self::pagefoot();\r
5005                 return;\r
5006         }\r
5007         \r
5008         /**\r
5009          * Admin::action_actionlog()\r
5010          * \r
5011          * @param       void\r
5012          * @return      void\r
5013          */\r
5014         static private function action_actionlog()\r
5015         {\r
5016                 global $member, $manager;\r
5017                 \r
5018                 $member->isAdmin() or self::disallow();\r
5019                 \r
5020                 self::pagehead();\r
5021                 self::$skin->parse('actionlog');\r
5022                 self::pagefoot();\r
5023                 return;\r
5024         }\r
5025         \r
5026         /**\r
5027          * Admin::action_banlist()\r
5028          * \r
5029          * @param       void\r
5030          * @return      void\r
5031          */\r
5032         static private function action_banlist()\r
5033         {\r
5034                 global $member, $manager;\r
5035                 \r
5036                 $member->blogAdminRights($blogid) or self::disallow();\r
5037                 \r
5038                 $blogid = intRequestVar('blogid');\r
5039                 \r
5040                 self::pagehead();\r
5041                 self::$skin->parse('banlist');\r
5042                 self::pagefoot();\r
5043                 return;\r
5044         }\r
5045         \r
5046         /**\r
5047          * Admin::action_banlistdelete()\r
5048          * \r
5049          * @param       void\r
5050          * @return      void\r
5051          */\r
5052         static private function action_banlistdelete()\r
5053         {\r
5054                 global $member, $manager;\r
5055                 \r
5056                 $blogid = intRequestVar('blogid');\r
5057                 $member->blogAdminRights($blogid) or self::disallow();\r
5058                 \r
5059                 self::pagehead();\r
5060                 self::$skin->parse('banlistdelete');\r
5061                 self::pagefoot();\r
5062                 return;\r
5063         }\r
5064         \r
5065         /**\r
5066          * Admin::action_banlistdeleteconfirm()\r
5067          * \r
5068          * @param       void\r
5069          * @return      void\r
5070          */\r
5071         static private function action_banlistdeleteconfirm()\r
5072         {\r
5073                 global $member, $manager;\r
5074                 \r
5075                 $member->blogAdminRights($blogid) or self::disallow();\r
5076                 \r
5077                 $blogid         = intPostVar('blogid');\r
5078                 $allblogs       = postVar('allblogs');\r
5079                 $iprange        = postVar('iprange');\r
5080                 \r
5081                 $deleted = array();\r
5082                 \r
5083                 if ( !$allblogs )\r
5084                 {\r
5085                         if ( Ban::removeBan($blogid, $iprange) )\r
5086                         {\r
5087                                 array_push($deleted, $blogid);\r
5088                         }\r
5089                 }\r
5090                 else\r
5091                 {\r
5092                         // get blogs fot which member has admin rights\r
5093                         $adminblogs = $member->getAdminBlogs();\r
5094                         foreach ($adminblogs as $blogje)\r
5095                         {\r
5096                                 if ( Ban::removeBan($blogje, $iprange) )\r
5097                                 {\r
5098                                         array_push($deleted, $blogje);\r
5099                                 }\r
5100                         }\r
5101                 }\r
5102                 \r
5103                 if ( sizeof($deleted) == 0 )\r
5104                 {\r
5105                         self::error(_ERROR_DELETEBAN);\r
5106                 }\r
5107                 \r
5108                 self::pagehead();\r
5109                 self::$skin->parse('banlistdeleteconfirm');\r
5110                 self::pagefoot();\r
5111                 return;\r
5112         }\r
5113         \r
5114         /**\r
5115          * Admin::action_banlistnewfromitem()\r
5116          * \r
5117          * @param       void\r
5118          * @return      void\r
5119          */\r
5120         static private function action_banlistnewfromitem()\r
5121         {\r
5122                 self::$action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5123                 return;\r
5124         }\r
5125         \r
5126         /**\r
5127          * Admin::action_banlistnew()\r
5128          * \r
5129          * @param       integer $blogid ID for weblog\r
5130          * @return      void\r
5131          */\r
5132         static private function action_banlistnew($blogid = '')\r
5133         {\r
5134                 global $member, $manager;\r
5135                 \r
5136                 if ( $blogid == '' )\r
5137                 {\r
5138                         $blogid = intRequestVar('blogid');\r
5139                 }\r
5140                 \r
5141                 $ip = requestVar('ip');\r
5142                 \r
5143                 $member->blogAdminRights($blogid) or self::disallow();\r
5144                 \r
5145                 /* TODO: we should consider to use the other way instead of this */\r
5146                 $_REQUEST['blogid'] = $blogid;          \r
5147                 \r
5148                 self::pagehead();\r
5149                 self::$skin->parse('banlistnew');\r
5150                 self::pagefoot();\r
5151                 \r
5152                 return;\r
5153         }\r
5154 \r
5155         /**\r
5156          * Admin::action_banlistadd()\r
5157          * \r
5158          * @param       void\r
5159          * @return      void\r
5160          */\r
5161         static private function action_banlistadd()\r
5162         {\r
5163                 global $member;\r
5164                 \r
5165                 $blogid         = intPostVar('blogid');\r
5166                 $allblogs       = postVar('allblogs');\r
5167                 $iprange        = postVar('iprange');\r
5168                 \r
5169                 if ( $iprange == "custom" )\r
5170                 {\r
5171                         $iprange = postVar('customiprange');\r
5172                 }\r
5173                 $reason   = postVar('reason');\r
5174                 \r
5175                 $member->blogAdminRights($blogid) or self::disallow();\r
5176                 \r
5177                 // TODO: check IP range validity\r
5178                 \r
5179                 if ( !$allblogs )\r
5180                 {\r
5181                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5182                         {\r
5183                                 self::error(_ERROR_ADDBAN);\r
5184                         }\r
5185                 }\r
5186                 else\r
5187                 {\r
5188                         // get blogs fot which member has admin rights\r
5189                         $adminblogs = $member->getAdminBlogs();\r
5190                         $failed = 0;\r
5191                         foreach ($adminblogs as $blogje)\r
5192                         {\r
5193                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5194                                 {\r
5195                                         $failed = 1;\r
5196                                 }\r
5197                         }\r
5198                         if ( $failed )\r
5199                         {\r
5200                                 self::error(_ERROR_ADDBAN);\r
5201                         }\r
5202                 }\r
5203                 self::$action_banlist();\r
5204                 return;\r
5205         }\r
5206         \r
5207         /**\r
5208          * Admin::action_clearactionlog()\r
5209          * \r
5210          * @param       void\r
5211          * @return      void\r
5212          */\r
5213         static private function action_clearactionlog()\r
5214         {\r
5215                 global $member;\r
5216                 \r
5217                 $member->isAdmin() or self::disallow();\r
5218                 \r
5219                 ActionLog::clear();\r
5220                 \r
5221                 self::$action_manage(_MSG_ACTIONLOGCLEARED);\r
5222                 return;\r
5223         }\r
5224         \r
5225         /**\r
5226          * Admin::action_backupoverview()\r
5227          * \r
5228          * @param       void\r
5229          * @return      void\r
5230          */\r
5231         static private function action_backupoverview()\r
5232         {\r
5233                 global $member, $manager;\r
5234                 \r
5235                 $member->isAdmin() or self::disallow();\r
5236                 \r
5237                 self::pagehead();\r
5238                 self::$skin->parse('backupoverview');\r
5239                 self::pagefoot();\r
5240                 return;\r
5241         }\r
5242 \r
5243         /**\r
5244          * Admin::action_backupcreate()\r
5245          * create file for backup\r
5246          * \r
5247          * @param               void\r
5248          * @return      void\r
5249          * \r
5250          */\r
5251         static private function action_backupcreate()\r
5252         {\r
5253                 global $member, $DIR_LIBS;\r
5254                 \r
5255                 $member->isAdmin() or self::disallow();\r
5256                 \r
5257                 // use compression ?\r
5258                 $useGzip = (integer) postVar('gzip');\r
5259                 \r
5260                 include($DIR_LIBS . 'backup.php');\r
5261                 \r
5262                 // try to extend time limit\r
5263                 // (creating/restoring dumps might take a while)\r
5264                 @set_time_limit(1200);\r
5265                 \r
5266                 Backup::do_backup($useGzip);\r
5267                 exit;\r
5268         }\r
5269         \r
5270         /**\r
5271          * Admin::action_backuprestore()\r
5272          * restoring from uploaded file\r
5273          * \r
5274          * @param               void\r
5275          * @return      void\r
5276          */\r
5277         static private function action_backuprestore()\r
5278         {\r
5279                 global $member, $DIR_LIBS;\r
5280                 \r
5281                 $member->isAdmin() or self::disallow();\r
5282                 \r
5283                 if ( intPostVar('letsgo') != 1 )\r
5284                 {\r
5285                         self::error(_ERROR_BACKUP_NOTSURE);\r
5286                 }\r
5287                 \r
5288                 include($DIR_LIBS . 'backup.php');\r
5289                 \r
5290                 // try to extend time limit\r
5291                 // (creating/restoring dumps might take a while)\r
5292                 @set_time_limit(1200);\r
5293                 \r
5294                 $message = Backup::do_restore();\r
5295                 if ( $message != '' )\r
5296                 {\r
5297                         self::error($message);\r
5298                 }\r
5299                 self::pagehead();\r
5300                 self::$skin->parse('backuprestore');\r
5301                 self::pagefoot();\r
5302                 return;\r
5303         }\r
5304         \r
5305         /**\r
5306          * Admin::action_pluginlist()\r
5307          * output the list of installed plugins\r
5308          * \r
5309          * @param       void\r
5310          * @return      void\r
5311          * \r
5312          */\r
5313         static private function action_pluginlist()\r
5314         {\r
5315                 global $DIR_PLUGINS, $member, $manager;\r
5316                 \r
5317                 // check if allowed\r
5318                 $member->isAdmin() or self::disallow();\r
5319                 \r
5320                 self::pagehead();\r
5321                 self::$skin->parse('pluginlist');\r
5322                 self::pagefoot();\r
5323                 return;\r
5324         }\r
5325         \r
5326         /**\r
5327          * Admin::action_pluginhelp()\r
5328          * \r
5329          * @param       void\r
5330          * @return      void\r
5331          */\r
5332         static private function action_pluginhelp()\r
5333         {\r
5334                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5335                 \r
5336                 // check if allowed\r
5337                 $member->isAdmin() or self::disallow();\r
5338                 \r
5339                 $plugid = intGetVar('plugid');\r
5340                 \r
5341                 if ( !$manager->pidInstalled($plugid) )\r
5342                 {\r
5343                         self::error(_ERROR_NOSUCHPLUGIN);\r
5344                 }\r
5345                 \r
5346                 self::pagehead();\r
5347                 self::$skin->parse('pluginhelp');\r
5348                 self::pagefoot();\r
5349                 return;\r
5350         }\r
5351         \r
5352         /**\r
5353          * Admin::action_pluginadd()\r
5354          * \r
5355          * @param       Void\r
5356          * @return      Void\r
5357          * \r
5358          */\r
5359         static private function action_pluginadd()\r
5360         {\r
5361                 global $member, $manager, $DIR_PLUGINS;\r
5362                 \r
5363                 // check if allowed\r
5364                 $member->isAdmin() or self::disallow();\r
5365                 \r
5366                 $name = postVar('filename');\r
5367                 \r
5368                 if ( $manager->pluginInstalled($name) )\r
5369                 {\r
5370                         self::error(_ERROR_DUPPLUGIN);\r
5371                 }\r
5372                 \r
5373                 if ( !checkPlugin($name) )\r
5374                 {\r
5375                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5376                 }\r
5377                 \r
5378                 // get number of currently installed plugins\r
5379                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5380                 $numCurrent = sql_num_rows($res);\r
5381                 \r
5382                 // plugin will be added as last one in the list\r
5383                 $newOrder = $numCurrent + 1;\r
5384                 \r
5385                 $data = array('file' => &$name);\r
5386                 $manager->notify('PreAddPlugin', $data);\r
5387                 \r
5388                 // do this before calling getPlugin (in case the plugin id is used there)\r
5389                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, '%s');";\r
5390                 $query = sprintf(sql_table('plugin'), (integer) $newOrder, sql_real_escape_string($name));\r
5391                 sql_query($query);\r
5392                 $iPid = sql_insert_id();\r
5393                 \r
5394                 $manager->clearCachedInfo('installedPlugins');\r
5395                 \r
5396                 // Load the plugin for condition checking and instalation\r
5397                 $plugin =& $manager->getPlugin($name);\r
5398                 \r
5399                 // check if it got loaded (could have failed)\r
5400                 if ( !$plugin )\r
5401                 {\r
5402                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5403                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5404                         \r
5405                         sql_query($query);\r
5406                         \r
5407                         $manager->clearCachedInfo('installedPlugins');\r
5408                         self::error(_ERROR_PLUGIN_LOAD);\r
5409                 }\r
5410                 \r
5411                 // check if plugin needs a newer Nucleus version\r
5412                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5413                 {\r
5414                         // uninstall plugin again...\r
5415                         self::deleteOnePlugin($plugin->getID());\r
5416                         \r
5417                         // ...and show error\r
5418                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5419                 }\r
5420                 \r
5421                 // check if plugin needs a newer Nucleus version\r
5422                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5423                 {\r
5424                         // uninstall plugin again...\r
5425                         self::deleteOnePlugin($plugin->getID());\r
5426                         \r
5427                         // ...and show error\r
5428                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5429                 }\r
5430                 \r
5431                 $pluginList = $plugin->getPluginDep();\r
5432                 foreach ( $pluginList as $pluginName )\r
5433                 {\r
5434                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');\r
5435                         if (sql_num_rows($res) == 0)\r
5436                         {\r
5437                                 // uninstall plugin again...\r
5438                                 self::deleteOnePlugin($plugin->getID());\r
5439                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5440                         }\r
5441                 }\r
5442                 \r
5443                 // call the install method of the plugin\r
5444                 $plugin->install();\r
5445                 \r
5446                 $data = array('plugin' => &$plugin);\r
5447                 $manager->notify('PostAddPlugin', $data);\r
5448                 \r
5449                 // update all events\r
5450                 self::$action_pluginupdate();\r
5451                 return;\r
5452         }\r
5453         \r
5454         /**\r
5455          * ADMIN:action_pluginupdate():\r
5456          * \r
5457          * @param       Void\r
5458          * @return      Void\r
5459          * \r
5460          */\r
5461         static private function action_pluginupdate()\r
5462         {\r
5463                 global $member, $manager, $CONF;\r
5464                 \r
5465                 // check if allowed\r
5466                 $member->isAdmin() or self::disallow();\r
5467                 \r
5468                 // delete everything from plugin_events\r
5469                 sql_query('DELETE FROM '.sql_table('plugin_event'));\r
5470                 \r
5471                 // loop over all installed plugins\r
5472                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5473                 while ( $o = sql_fetch_object($res) )\r
5474                 {\r
5475                         $pid  =  $o->pid;\r
5476                         $plug =& $manager->getPlugin($o->pfile);\r
5477                         if ( $plug )\r
5478                         {\r
5479                                 $eventList = $plug->getEventList();\r
5480                                 foreach ( $eventList as $eventName )\r
5481                                 {\r
5482                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, '%s')";\r
5483                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, sql_real_escape_string($eventName));\r
5484                                         sql_query($query);\r
5485                                 }\r
5486                         }\r
5487                 }\r
5488                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5489                 return;\r
5490         }\r
5491         \r
5492         /**\r
5493          * Admin::action_plugindelete()\r
5494          * \r
5495          * @param       void\r
5496          * @return      void\r
5497          */\r
5498         static private function action_plugindelete()\r
5499         {\r
5500                 global $member, $manager;\r
5501                 \r
5502                 // check if allowed\r
5503                 $member->isAdmin() or self::disallow();\r
5504                 \r
5505                 $pid = intGetVar('plugid');\r
5506                 \r
5507                 if ( !$manager->pidInstalled($pid) )\r
5508                 {\r
5509                         self::error(_ERROR_NOSUCHPLUGIN);\r
5510                 }\r
5511                 \r
5512                 self::pagehead();\r
5513                 self::$skin->parse('plugindelete');\r
5514                 self::pagefoot();\r
5515                 return;\r
5516         }\r
5517 \r
5518         /**\r
5519          * Admin::action_plugindeleteconfirm()\r
5520          * \r
5521          * @param       void\r
5522          * @return      void\r
5523          */\r
5524         static private function action_plugindeleteconfirm()\r
5525         {\r
5526                 global $member, $manager, $CONF;\r
5527                 \r
5528                 // check if allowed\r
5529                 $member->isAdmin() or self::disallow();\r
5530                 \r
5531                 $pid = intPostVar('plugid');\r
5532                 \r
5533                 $error = self::deleteOnePlugin($pid, 1);\r
5534                 if ( $error )\r
5535                 {\r
5536                         self::error($error);\r
5537                 }\r
5538                 \r
5539                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5540                 return;\r
5541         }\r
5542         \r
5543         /**\r
5544          * Admin::\r
5545          * \r
5546          * @param       void\r
5547          * @return      void\r
5548          */\r
5549         static private function deleteOnePlugin($pid, $callUninstall = 0)\r
5550         {\r
5551                 global $manager;\r
5552                 \r
5553                 $pid = intval($pid);\r
5554                 \r
5555                 if ( !$manager->pidInstalled($pid) )\r
5556                 {\r
5557                         return _ERROR_NOSUCHPLUGIN;\r
5558                 }\r
5559                 \r
5560                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5561                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5562                 $name = quickQuery($query);\r
5563                 \r
5564                 // check dependency before delete\r
5565                 $res = sql_query('SELECT pfile FROM ' . sql_table('plugin'));\r
5566                 while ($o = sql_fetch_object($res))\r
5567                 {\r
5568                         $plug =& $manager->getPlugin($o->pfile);\r
5569                         if ( $plug )\r
5570                         {\r
5571                                 $depList = $plug->getPluginDep();\r
5572                                 foreach ( $depList as $depName )\r
5573                                 {\r
5574                                         if ( $name == $depName )\r
5575                                         {\r
5576                                                 return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);\r
5577                                         }\r
5578                                 }\r
5579                         }\r
5580                 }\r
5581                 \r
5582                 $data = array('plugid' => $pid);\r
5583                 $manager->notify('PreDeletePlugin', $data);\r
5584                 \r
5585                 // call the unInstall method of the plugin\r
5586                 if ( $callUninstall )\r
5587                 {\r
5588                         $plugin =& $manager->getPlugin($name);\r
5589                         if ( $plugin )\r
5590                         {\r
5591                                 $plugin->unInstall();\r
5592                         }\r
5593                 }\r
5594                 \r
5595                 // delete all subscriptions\r
5596                 sql_query('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5597                 \r
5598                 // delete all options\r
5599                 // get OIDs from plugin_option_desc\r
5600                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5601                 $aOIDs = array();\r
5602                 while ($o = sql_fetch_object($res))\r
5603                 {\r
5604                         array_push($aOIDs, $o->oid);\r
5605                 }\r
5606                 \r
5607                 // delete from plugin_option and plugin_option_desc\r
5608                 sql_query('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5609                 if (count($aOIDs) > 0)\r
5610                 {\r
5611                         sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5612                 }\r
5613                 \r
5614                 // update order numbers\r
5615                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5616                 $o = sql_fetch_object($res);\r
5617                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $o->porder);\r
5618                 \r
5619                 // delete row\r
5620                 sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5621                 \r
5622                 $manager->clearCachedInfo('installedPlugins');\r
5623                 $data = array('plugid' => $pid);\r
5624                 $manager->notify('PostDeletePlugin', $data);\r
5625                 \r
5626                 return '';\r
5627         }\r
5628         \r
5629         /**\r
5630          * Admin::action_pluginup()\r
5631          * \r
5632          * @param       void\r
5633          * @return      void\r
5634          */\r
5635         static private function action_pluginup()\r
5636         {\r
5637                 global $member, $manager, $CONF;\r
5638                 \r
5639                 // check if allowed\r
5640                 $member->isAdmin() or self::disallow();\r
5641                 \r
5642                 $plugid = intGetVar('plugid');\r
5643                 \r
5644                 if ( !$manager->pidInstalled($plugid) )\r
5645                 {\r
5646                         self::error(_ERROR_NOSUCHPLUGIN);\r
5647                 }\r
5648                 \r
5649                 // 1. get old order number\r
5650                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5651                 $o = sql_fetch_object($res);\r
5652                 $oldOrder = $o->porder;\r
5653                 \r
5654                 // 2. calculate new order number\r
5655                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5656                 \r
5657                 // 3. update plug numbers\r
5658                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5659                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5660                 \r
5661                 //self::$action_pluginlist();\r
5662                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5663                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5664                 return;\r
5665         }\r
5666         \r
5667         /**\r
5668          * Admin::action_plugindown()\r
5669          * \r
5670          * @param       void\r
5671          * @return      void\r
5672          */\r
5673         static private function action_plugindown()\r
5674         {\r
5675                 global $member, $manager, $CONF;\r
5676                 \r
5677                 // check if allowed\r
5678                 $member->isAdmin() or self::disallow();\r
5679                 \r
5680                 $plugid = intGetVar('plugid');\r
5681                 if ( !$manager->pidInstalled($plugid) )\r
5682                 {\r
5683                         self::error(_ERROR_NOSUCHPLUGIN);\r
5684                 }\r
5685                 \r
5686                 // 1. get old order number\r
5687                 $res = sql_query('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5688                 $o = sql_fetch_object($res);\r
5689                 $oldOrder = $o->porder;\r
5690                 \r
5691                 $res = sql_query('SELECT * FROM ' . sql_table('plugin'));\r
5692                 $maxOrder = sql_num_rows($res);\r
5693                 \r
5694                 // 2. calculate new order number\r
5695                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5696                 \r
5697                 // 3. update plug numbers\r
5698                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5699                 sql_query('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5700                 \r
5701                 //self::$action_pluginlist();\r
5702                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5703                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5704                 return;\r
5705         }\r
5706         \r
5707         /**\r
5708          * Admin::action_pluginoptions()\r
5709          * \r
5710          * Output Plugin option page\r
5711          * \r
5712          * @access      public\r
5713          * @param       string $message message when fallbacked\r
5714          * @return      void\r
5715          * \r
5716          */\r
5717         static private function action_pluginoptions($message = '')\r
5718         {\r
5719                 global $member, $manager;\r
5720                 \r
5721                 // check if allowed\r
5722                 $member->isAdmin() or self::disallow();\r
5723                 \r
5724                 $pid = intRequestVar('plugid');\r
5725                 if ( !$manager->pidInstalled($pid) )\r
5726                 {\r
5727                         self::error(_ERROR_NOSUCHPLUGIN);\r
5728                 }\r
5729                 \r
5730                 if ( isset($message) )\r
5731                 {\r
5732                         self::$headMess = $message;\r
5733                 }\r
5734                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5735                 self::pagehead($extrahead);\r
5736                 self::$skin->parse('pluginoptions');\r
5737                 self::pagefoot();\r
5738                 return;\r
5739         }\r
5740         \r
5741         /**\r
5742          * Admin::action_pluginoptionsupdate()\r
5743          * \r
5744          * Update plugin options and fallback to plugin option page\r
5745          * \r
5746          * @access      public\r
5747          * @param       void\r
5748          * @return      void\r
5749          */\r
5750         static private function action_pluginoptionsupdate()\r
5751         {\r
5752                 global $member, $manager;\r
5753                 \r
5754                 // check if allowed\r
5755                 $member->isAdmin() or self::disallow();\r
5756                 \r
5757                 $pid = intRequestVar('plugid');\r
5758                 \r
5759                 if ( !$manager->pidInstalled($pid) )\r
5760                 {\r
5761                         self::error(_ERROR_NOSUCHPLUGIN);\r
5762                 }\r
5763                 \r
5764                 $aOptions = requestArray('plugoption');\r
5765                 NucleusPlugin::apply_plugin_options($aOptions);\r
5766                 \r
5767                 $data = array(\r
5768                         'context'       => 'global',\r
5769                         'plugid'        => $pid\r
5770                 );\r
5771                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5772                 \r
5773                 self::$action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5774                 return;\r
5775         }\r
5776         \r
5777         /**\r
5778          * Admin::insertPluginOptions()\r
5779          * \r
5780          * Output plugin option field\r
5781          * \r
5782          * @access      public\r
5783          * @param string        $context        plugin option context\r
5784          * @param integer       $contextid      plugin option context id\r
5785          * @return      void\r
5786          */\r
5787         static public function insertPluginOptions($context, $contextid = 0)\r
5788         {\r
5789                 global $manager;\r
5790                 \r
5791                 // get all current values for this contextid\r
5792                 // (note: this might contain doubles for overlapping contextids)\r
5793                 $aIdToValue = array();\r
5794                 \r
5795                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5796                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5797                 \r
5798                 $res = sql_query($query);\r
5799                 while ( $object = sql_fetch_object($res) )\r
5800                 {\r
5801                         $aIdToValue[$object->oid] = $object->ovalue;\r
5802                 }\r
5803                 \r
5804                 // get list of oids per pid\r
5805                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= '%s' ORDER BY porder, oid ASC;";\r
5806                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), sql_real_escape_string($context));\r
5807                 $res    = sql_query($query);\r
5808                 \r
5809                 $aOptions = array();\r
5810                 while ( $object = sql_fetch_object($res) )\r
5811                 {\r
5812                         if ( !in_array($object->oid, array_keys($aIdToValue)) )\r
5813                         {\r
5814                                 $value = $object->odef;\r
5815                         }\r
5816                         else\r
5817                         {\r
5818                                 $value = $aIdToValue[$object->oid];\r
5819                         }\r
5820                         \r
5821                         array_push(\r
5822                                 $aOptions,\r
5823                                 array(\r
5824                                         'pid'                   => $object->pid,\r
5825                                         'pfile'                 => $object->pfile,\r
5826                                         'oid'                   => $object->oid,\r
5827                                         'value'                 => $value,\r
5828                                         'name'                  => $object->oname,\r
5829                                         'description'   => $object->odesc,\r
5830                                         'type'                  => $object->otype,\r
5831                                         'typeinfo'              => $object->oextra,\r
5832                                         'contextid'             => $contextid,\r
5833                                         'extra'                 => ''\r
5834                                 )\r
5835                         );\r
5836                 }\r
5837                 \r
5838                 $data = array(\r
5839                         'context'       =>  $context,\r
5840                         'contextid'     =>  $contextid,\r
5841                         'options'       =>& $aOptions\r
5842                 );\r
5843                 $manager->notify('PrePluginOptionsEdit', $data);\r
5844                 \r
5845                 self::$aOptions = $aOptions;\r
5846                 self::$skin->parse('insertpluginoptions');\r
5847                 return;\r
5848         }\r
5849         \r
5850         /**\r
5851          * Admin::action_parseSpecialskin()\r
5852          * \r
5853          * @param       void\r
5854          * @return      void\r
5855          */\r
5856         static private function action_parseSpecialskin()\r
5857         {\r
5858                 self::pagehead();\r
5859                 self::$skin->parse(self::$action);\r
5860                 self::pagefoot();\r
5861                 return;\r
5862         }\r
5863         \r
5864         /*\r
5865          * TODO: use Skin class instead of this\r
5866         static private function parse($type)\r
5867         {\r
5868                 global $manager, $CONF;\r
5869                 \r
5870                 if ( $type == 'pagehead' )\r
5871                 {\r
5872                         $data = array(\r
5873                                 'skin' => &self::$skin,\r
5874                                 'type' => $type\r
5875                         );\r
5876                         \r
5877                         $manager->notify('InitAdminSkinParse', $data);\r
5878                         sendContentType(self::$skin->getContentType(), 'skin', i18n::get_current_charset());\r
5879                 }\r
5880                 \r
5881                 $contents = self::$skin->getContent($type);\r
5882                 \r
5883                 if ( !$contents )\r
5884                 {\r
5885                         echo _ERROR_SKIN;\r
5886                         return;\r
5887                 }\r
5888                 \r
5889                 $actions = self::$skin->getAllowedActionsForType($type);\r
5890                 \r
5891                 if ( $type == 'pagehead' )\r
5892                 {\r
5893                         $data = array(\r
5894                                 'skin'          => &self::$skin,\r
5895                                 'type'          => $type,\r
5896                                 'contents'      => &$contents\r
5897                         );\r
5898                         \r
5899                         $manager->notify('PreAdminSkinParse', $data);\r
5900                 }\r
5901                 \r
5902                 PARSER::setProperty('IncludeMode', self::$skin->getIncludeMode());\r
5903                 PARSER::setProperty('IncludePrefix', self::$skin->getIncludePrefix());\r
5904                 \r
5905                 if ( $type == 'createitem' || $type == 'itemedit' )\r
5906                 {\r
5907                         // TODO: where is this class???\r
5908                         $handler = new Factory(intRequestVar('blogid'), $type, self::$skin, $this);\r
5909                         $actions = array_merge($actions, $handler->actions);\r
5910                 }\r
5911                 else\r
5912                 {\r
5913                         // TODO: why???\r
5914                         $actions = array_merge($actions, self::$skin->getAllowedActionsForType($type));\r
5915                 }\r
5916                 \r
5917                 $parser = new Parser($actions, $handler);\r
5918                 $handler->setParser($parser);\r
5919                 $handler->setSkin(self::$skin);\r
5920                 $parser->parse($contents);\r
5921                 \r
5922                 if ( $type == 'pagefoot' )\r
5923                 {\r
5924                         $data = array(\r
5925                                 'skin'  => &self::$skin,\r
5926                                 'type'  => $type,\r
5927                         );\r
5928                         \r
5929                         $manager->notify('PostAdminSkinParse', $data);\r
5930                 }\r
5931                 return;\r
5932         }\r
5933         */\r
5934         \r
5935         /**\r
5936          * Admin::getAdminskinIDFromName()\r
5937          * \r
5938          * @param       string  $skinname       name of skin\r
5939          * @return      integer ID for skin\r
5940          */\r
5941         static private function getAdminskinIDFromName($skinname)\r
5942         {\r
5943                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = '%s';";\r
5944                 $query          = sprintf($query, sql_table('skin_desc'), mysql_real_escape_string($skinname));\r
5945                 $admnSknID      = quickQuery($query);\r
5946                 return (integer) $adminSkinID;\r
5947         }\r
5948         \r
5949         /**\r
5950          * Admin::getAdminskinNameFromID()\r
5951          * \r
5952          * @param       integer $skinid ID for skin\r
5953          * @return      integer ID for skin\r
5954          */\r
5955         static private function getAdminskinNameFromID($skinid)\r
5956         {\r
5957                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = '%d';";\r
5958                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5959                 $admnSknID      = quickQuery($query);\r
5960                 return (integer) $adminSkinID;\r
5961         }\r
5962         \r
5963         /**\r
5964          * Admin::getAdminextrahead()\r
5965          */\r
5966         static function getAdminextrahead()\r
5967         {\r
5968                 return self::$extrahead;\r
5969         }\r
5970         \r
5971         /**\r
5972          * Admin::getAdminAction()\r
5973          */\r
5974         static function getAdminAction()\r
5975         {\r
5976                 return self::$action;\r
5977         }\r
5978         \r
5979         /**\r
5980          * Admin::action_importAdmin()\r
5981          * \r
5982          * @param       void\r
5983          * @return      void\r
5984          */\r
5985         static private function action_importAdmin()\r
5986         {\r
5987                 global $DIR_ADMINSKINS, $action;\r
5988                 if ( $action == 'adminskinieimport' )\r
5989                 {\r
5990                         self::doAdminskinimport();\r
5991                 }\r
5992                 $skn = array();\r
5993                 if ( $action == 'showlogin' )\r
5994                 {\r
5995                         $skinName = 'showlogin';\r
5996                         $actnName = 'showlogin';\r
5997                 }\r
5998                 else\r
5999                 {\r
6000                         $skinName = 'defaultimporter';\r
6001                         $actnName = 'importAdmin';\r
6002                 }\r
6003                 \r
6004                 /* TODO: why??? */\r
6005                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6006                 $skn['id']                              = 0;\r
6007                 $skn['description']             = $skinName;\r
6008                 $skn['contentType']             = 'importAdmin';\r
6009                 $skn['includeMode']             = 'normal';\r
6010                 $skn['includePrefix']   = '';\r
6011                 $skn['name']                    = 'defaultinporter';\r
6012                 \r
6013                 self::$skin                             = (object) $skn;\r
6014                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6015                 $actions = Skin::getAllowedActionsForType($actnName);\r
6016                 \r
6017                 $parser = new PARSER($actions, $handler);\r
6018                 $handler->setParser($parser);\r
6019                 $handler->setSkin(self::$skin);\r
6020                 $parser->parse($contents);\r
6021                 return;\r
6022         }\r
6023         \r
6024         /**\r
6025          * Admin::doAdminskinimport()\r
6026          * \r
6027          * @param       void\r
6028          * @return      void\r
6029          */\r
6030         static private function doAdminskinimport()\r
6031         {\r
6032                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6033                 \r
6034                 $member->isAdmin() or self::disallow();\r
6035                 \r
6036                 include_once($DIR_LIBS . 'Skinie.php');\r
6037                 $skinFileRaw    = postVar('skinfile');\r
6038                 $mode                   = postVar('mode');\r
6039                 $allowOverwrite = intPostVar('overwrite');\r
6040                 \r
6041                 if ( $mode == 'file' )\r
6042                 {\r
6043                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6044                 }\r
6045                 else\r
6046                 {\r
6047                         $skinFile = $skinFileRaw;\r
6048                 }\r
6049                 \r
6050                 $importer       = new SKINIMPORT();\r
6051                 $error          = $importer->readFile($skinFile);\r
6052                 if ( $error )\r
6053                 {\r
6054                         self::error($error);\r
6055                 }\r
6056                 $error = $importer->writeToDatabase($allowOverwrite);\r
6057                 if ( $error )\r
6058                 {\r
6059                         self::error($error);\r
6060                 }\r
6061                 \r
6062                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6063                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6064                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6065                 \r
6066                 header('Location: ' . $CONF['AdminURL']);\r
6067                 exit;\r
6068         }\r
6069 }\r