nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $extrahead;\r
  35         static private $passvar;\r
  36         static private $aOptions;\r
  37         \r
  38         static public $blog;\r
  39         static public $item;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56                 );\r
  57 \r
  58                 /**\r
  59                  * Admin::$skinless_actions\r
  60                  */\r
  61                 static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'deleteblog',\r
 107                 'editmembersettings',\r
 108                 'browseownitems',\r
 109                 'browseowncomments',\r
 110                 'createitem',\r
 111                 'itemedit',\r
 112                 'itemmove',\r
 113                 'categoryedit',\r
 114                 'categorydelete',\r
 115                 'manage',\r
 116                 'actionlog',\r
 117                 'settingsedit',\r
 118                 'backupoverview',\r
 119                 'pluginlist',\r
 120                 'createnewlog',\r
 121                 'usermanagement',\r
 122                 'skinoverview',\r
 123                 'templateoverview',\r
 124                 'skinieoverview',\r
 125                 'itemcommentlist',\r
 126                 'commentedit',\r
 127                 'commentdelete',\r
 128                 'banlistnewfromitem',\r
 129                 'banlistdelete',\r
 130                 'itemdelete',\r
 131                 'manageteam',\r
 132                 'teamdelete',\r
 133                 'banlistnew',\r
 134                 'memberedit',\r
 135                 'memberdelete',\r
 136                 'pluginhelp',\r
 137                 'pluginoptions',\r
 138                 'plugindelete',\r
 139                 'skinedittype',\r
 140                 'skinremovetype',\r
 141                 'skindelete',\r
 142                 'skinedit',\r
 143                 'templateedit',\r
 144                 'templatedelete',\r
 145                 'activate',\r
 146                 'systemoverview',\r
 147                 'activatesetpwd',\r
 148         );\r
 149         \r
 150         static public function initialize()\r
 151         {\r
 152                 global $CONF, $DIR_LIBS;\r
 153                 \r
 154                 /* NOTE: 1. decide which skinid to use */\r
 155                 $skinid = $CONF['AdminSkin'];\r
 156                 /*\r
 157                  * NOTE: this is temporary escaped because not implemented yet\r
 158                 if (isset($member) && $member->isLoggedIn())\r
 159                 {\r
 160                         $memskin = $member->getAdminSkin();\r
 161                         if ( $memskin )\r
 162                         {\r
 163                                 $skinid = $memskin;\r
 164                         }\r
 165                 }\r
 166                 */\r
 167                 \r
 168                 /* NOTE: 2. make an instance of skin object */\r
 169                 if ( !Skin::existsID($skinid) )\r
 170                 {\r
 171                         return FALSE;\r
 172                 }\r
 173                 \r
 174                 /* NOTE: 3. initializing each members */\r
 175                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 176                 self::$action           = '';\r
 177                 self::$extrahead        = '';\r
 178                 self::$passvar          = '';\r
 179                 self::$headMess         = '';\r
 180                 self::$aOptions         = '';\r
 181                 return TRUE;\r
 182         }\r
 183         \r
 184         /**\r
 185          * Admin::action()\r
 186          * Executes an action\r
 187          *\r
 188          * @param       string  $action action to be performed\r
 189          * @return      void\r
 190          */\r
 191         static public function action($action)\r
 192         {\r
 193                 global $CONF, $DIR_LIBS, $manager, $member;\r
 194                 \r
 195                 /* 1. decide action name */\r
 196                 $customAction = postvar('customaction');\r
 197                 if ( !empty($customAction) )\r
 198                 {\r
 199                         $alias = array(\r
 200                                 'login' => $customAction,\r
 201                                 ''              => $customAction\r
 202                         );\r
 203                 }\r
 204                 else\r
 205                 {\r
 206                         $alias = array(\r
 207                                 'login' => 'overview',\r
 208                                 ''              => 'overview',\r
 209                                 'admntemplateoverview' => 'admintemplateoverview'\r
 210                         );\r
 211                 }\r
 212                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 213                 {\r
 214                         $action = $alias[$action];\r
 215                 }\r
 216                 $methodName = "action_{$action}";\r
 217                 self::$action = strtolower($action);\r
 218                 \r
 219                 /* 2. check the action */\r
 220                 $synonimActions = array(\r
 221                         'banlistnewfromitem',\r
 222                         'memberedit',\r
 223                         'login',\r
 224                 );\r
 225                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 226                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 227                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 228                 {\r
 229                         if (!$manager->checkTicket())\r
 230                         {\r
 231                                 self::error(_ERROR_BADTICKET);\r
 232                         }\r
 233                 }\r
 234 \r
 235                 /* 3. parse according to the action */\r
 236                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 237                 {\r
 238                         /* TODO: what is this?\r
 239                         self::action_parseSpecialskin();\r
 240                         */\r
 241                 }\r
 242                 elseif ( method_exists('Admin', $methodName) )\r
 243                 {\r
 244                         call_user_func(array(__CLASS__, $methodName));\r
 245                 }\r
 246                 else if ( self::existsSkinContents('adminerrorpage') )\r
 247                 {\r
 248                         self::error(_BADACTION . ENTITY::hsc($action));\r
 249                 }\r
 250                 elseif ( $id != $CONF['AdminSkin'] )\r
 251                 {\r
 252                         self::$skin = new Skin($CONF['AdminSkin']);\r
 253                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 254                         {\r
 255                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 256                         }\r
 257                 }\r
 258                 else\r
 259                 {\r
 260                         self::error(_BADACTION . ENTITY::hsc($action));\r
 261                 }\r
 262                 exit;\r
 263         }\r
 264         \r
 265         /**\r
 266          * Action::existsSkinContents()\r
 267          * Check skin contents\r
 268          *\r
 269          * @param       string  $action action type\r
 270          * @return      boolean\r
 271          */\r
 272         static private function existsSkinContents($action)\r
 273         {\r
 274                 $in_array  = in_array($action, self::$skinless_actions);\r
 275                 \r
 276                 if ( $in_array )\r
 277                 {\r
 278                         return $in_array;\r
 279                 }\r
 280                 else\r
 281                 {\r
 282                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 283                         /* TODO: skinid should be a default */\r
 284                         if ( !is_object(self::$skin) )\r
 285                         {\r
 286                                 global $CONF;\r
 287                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 288                         }\r
 289                         else\r
 290                         {\r
 291                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 292                         }\r
 293                 }\r
 294                 return;\r
 295         }\r
 296         \r
 297         /**\r
 298          * Action::specialActionsAllow()\r
 299          * Check exists specialskinparts\r
 300          *\r
 301          * @param       string  $action action type\r
 302          * @return boolean\r
 303          */\r
 304         static private function specialActionsAllow($action)\r
 305         {\r
 306                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 307                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 308                 return DB::getValue($query);\r
 309         }\r
 310         \r
 311         /**\r
 312          * Action::action_showlogin()\r
 313          * \r
 314          * @param       void\r
 315          * @return      void\r
 316          */\r
 317         static private function action_showlogin()\r
 318         {\r
 319                 global $error;\r
 320                 self::action_login($error);\r
 321                 return;\r
 322         }\r
 323         \r
 324         /**\r
 325          * Action::action_login()\r
 326          * \r
 327          * @param       string  $msg            message for pageheader\r
 328          * @param       integer $passvars       ???\r
 329          */\r
 330         static private function action_login($msg = '', $passvars = 1)\r
 331         {\r
 332                 global $member;\r
 333                 \r
 334                 // skip to overview when allowed\r
 335                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 336                 {\r
 337                         self::action_overview();\r
 338                         exit;\r
 339                 }\r
 340                 \r
 341                 /* TODO: needless variable??? */\r
 342                 self::$passvar = $passvars;\r
 343                 if ( $msg )\r
 344                 {\r
 345                         self::$headMess = $msg;\r
 346                 }\r
 347                 \r
 348                 self::$skin->parse('showlogin');\r
 349         }\r
 350         \r
 351         /**\r
 352          * Action::action_overview()\r
 353          * provides a screen with the overview of the actions available\r
 354          * \r
 355          * @param       string  $msg    message for pageheader\r
 356          * @return      void\r
 357          */\r
 358         static private function action_overview($msg = '')\r
 359         {\r
 360                 if ( $msg )\r
 361                 {\r
 362                         self::$headMess = $msg;\r
 363                 }\r
 364                 \r
 365                 self::$skin->parse('overview');\r
 366                 return;\r
 367         }\r
 368         \r
 369         /**\r
 370          * Admin::action_manage()\r
 371          * \r
 372          * @param       string  $msg    message for pageheader\r
 373          * @retrn       void\r
 374          */\r
 375         static private function action_manage($msg = '')\r
 376         {\r
 377                 global $member;\r
 378                 \r
 379                 if ( $msg )\r
 380                 {\r
 381                         self::$headMess = $msg;\r
 382                 }\r
 383                 $member->isAdmin() or self::disallow();\r
 384                 \r
 385                 self::$skin->parse('manage');\r
 386                 return;\r
 387         }\r
 388         \r
 389         /**\r
 390          * Action::action_itemlist()\r
 391          * \r
 392          * @param       integer id for weblod\r
 393          * @return      void\r
 394          */\r
 395         static private function action_itemlist($blogid = '')\r
 396         {\r
 397                 global $member, $manager, $CONF;\r
 398                 \r
 399                 if ( $blogid == '' )\r
 400                 {\r
 401                         $blogid = intRequestVar('blogid');\r
 402                 }\r
 403                 \r
 404                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 405                 \r
 406                 self::$skin->parse('itemlist');\r
 407                 return;\r
 408         }\r
 409         \r
 410         /**\r
 411          * Action::action_batchitem()\r
 412          * \r
 413          * @param       void\r
 414          * @return      void\r
 415          */\r
 416         static private function action_batchitem()\r
 417         {\r
 418                 global $member, $manager;\r
 419                 \r
 420                 $member->isLoggedIn() or self::disallow();\r
 421                 \r
 422                 $selected       = requestIntArray('batch');\r
 423                 $action         = requestVar('batchaction');\r
 424                 \r
 425                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 426                 {\r
 427                         self::error(_BATCH_NOSELECTION);\r
 428                 }\r
 429                 \r
 430                 // On move: when no destination blog/category chosen, show choice now\r
 431                 $destCatid = intRequestVar('destcatid');\r
 432                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 433                 {\r
 434                         self::batchMoveSelectDestination('item', $selected);\r
 435                 }\r
 436                 \r
 437                 // On delete: check if confirmation has been given\r
 438                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 439                 {\r
 440                         self::batchAskDeleteConfirmation('item', $selected);\r
 441                 }\r
 442                 \r
 443                 self::$skin->parse('batchitem');\r
 444                 return;\r
 445         }\r
 446         \r
 447         /**\r
 448          * Action::action_batchcomment()\r
 449          * \r
 450          * @param       void\r
 451          * @return      void\r
 452          */\r
 453         static private function action_batchcomment()\r
 454         {\r
 455                 global $member;\r
 456                 \r
 457                 $member->isLoggedIn() or self::disallow();\r
 458                 \r
 459                 $selected       = requestIntArray('batch');\r
 460                 $action         = requestVar('batchaction');\r
 461                 \r
 462                 // Show error when no items were selected\r
 463                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 464                 {\r
 465                         self::error(_BATCH_NOSELECTION);\r
 466                 }\r
 467                 \r
 468                 // On delete: check if confirmation has been given\r
 469                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 470                 {\r
 471                         self::batchAskDeleteConfirmation('comment', $selected);\r
 472                 }\r
 473                 \r
 474                 self::$skin->parse('batchcomment');\r
 475                 return;\r
 476         }\r
 477         \r
 478         /**\r
 479          * Admin::setAdminAction()\r
 480          *\r
 481          * @param       string  $action\r
 482          * @return      void\r
 483          */\r
 484         static public function setAdminAction($action)\r
 485         {\r
 486                 self::$action = $action;\r
 487                 return;\r
 488         }\r
 489         \r
 490         /**\r
 491          * Admin::action_batchmember()\r
 492          * \r
 493          * @param       void\r
 494          * @return      void\r
 495          */\r
 496         static private function action_batchmember()\r
 497         {\r
 498                 global $member;\r
 499                 \r
 500                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 501                 \r
 502                 $selected       = requestIntArray('batch');\r
 503                 $action         = requestVar('batchaction');\r
 504                 \r
 505                 // Show error when no members selected\r
 506                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 507                 {\r
 508                         self::error(_BATCH_NOSELECTION);\r
 509                 }\r
 510                 \r
 511                 // On delete: check if confirmation has been given\r
 512                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 513                 {\r
 514                         self::batchAskDeleteConfirmation('member',$selected);\r
 515                 }\r
 516                 \r
 517                 self::$skin->parse('batchmember');\r
 518                 return;\r
 519         }\r
 520         \r
 521         /**\r
 522          * Admin::action_batchteam()\r
 523          * \r
 524          * @param       void\r
 525          * @return      void\r
 526          */\r
 527         static private function action_batchteam()\r
 528         {\r
 529                 global $member;\r
 530                 \r
 531                 $blogid = intRequestVar('blogid');\r
 532                 \r
 533                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 534                 \r
 535                 $selected       = requestIntArray('batch');\r
 536                 $action         = requestVar('batchaction');\r
 537                 \r
 538                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 539                 {\r
 540                         self::error(_BATCH_NOSELECTION);\r
 541                 }\r
 542                 \r
 543                 // On delete: check if confirmation has been given\r
 544                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 545                 {\r
 546                         self::batchAskDeleteConfirmation('team',$selected);\r
 547                 }\r
 548                 \r
 549                 self::$skin->parse('batchteam');\r
 550                 return;\r
 551         }\r
 552         \r
 553         /**\r
 554          * Admin::action_batchcategory()\r
 555          * \r
 556          * @param       void\r
 557          * @return      void\r
 558          */\r
 559         static private function action_batchcategory()\r
 560         {\r
 561                 global $member, $manager;\r
 562                 \r
 563                 $member->isLoggedIn() or self::disallow();\r
 564                 \r
 565                 $selected       = requestIntArray('batch');\r
 566                 $action         = requestVar('batchaction');\r
 567                 \r
 568                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 569                 {\r
 570                         self::error(_BATCH_NOSELECTION);\r
 571                 }\r
 572                 \r
 573                 // On move: when no destination blog chosen, show choice now\r
 574                 $destBlogId = intRequestVar('destblogid');\r
 575                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 576                 {\r
 577                         self::batchMoveCategorySelectDestination('category', $selected);\r
 578                 }\r
 579                 \r
 580                 // On delete: check if confirmation has been given\r
 581                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 582                 {\r
 583                         self::batchAskDeleteConfirmation('category', $selected);\r
 584                 }\r
 585                 \r
 586                 self::$skin->parse('batchcategory');\r
 587                 return;\r
 588         }\r
 589         \r
 590         /**\r
 591          * Admin::batchMoveSelectDestination()\r
 592          * \r
 593          * @param       string  $type   type of batch action\r
 594          * @param       integer $ids    needless???\r
 595          * @return      void\r
 596          * \r
 597          * TODO: remove needless argument\r
 598          */\r
 599         static private function batchMoveSelectDestination($type, $ids)\r
 600         {\r
 601                 $_POST['batchmove'] = $type;\r
 602                 self::$skin->parse('batchmove');\r
 603                 return;\r
 604         }\r
 605         \r
 606         /**\r
 607          * Admin::batchMoveCategorySelectDestination()\r
 608          * \r
 609          * @param       string  $type   type of batch action\r
 610          * @param       integer $ids    needless???\r
 611          * @return      void\r
 612          * \r
 613          * TODO: remove needless argument\r
 614          */\r
 615         static private function batchMoveCategorySelectDestination($type, $ids)\r
 616         {\r
 617                 $_POST['batchmove'] = $type;\r
 618                 global $manager;\r
 619                 self::$skin->parse('batchmovecat');\r
 620                 return;\r
 621         }\r
 622         \r
 623         /**\r
 624          * Admin::batchAskDeleteConfirmation()\r
 625          * \r
 626          * @param       string  $type   type of batch action\r
 627          * @param       integer $ids    needless???\r
 628          * @return      void\r
 629          * \r
 630          * TODO: remove needless argument\r
 631          */\r
 632         static private function batchAskDeleteConfirmation($type, $ids)\r
 633         {\r
 634                 self::$skin->parse('batchdelete');\r
 635                 return;\r
 636         }\r
 637         \r
 638         /**\r
 639          * Admin::action_browseownitems()\r
 640          * \r
 641          * @param       void\r
 642          * @return      void\r
 643          */\r
 644         static private function action_browseownitems()\r
 645         {\r
 646                 global $member, $manager, $CONF;\r
 647                 \r
 648                 self::$skin->parse('browseownitems');\r
 649                 return;\r
 650         }\r
 651         \r
 652         /**\r
 653          * Admin::action_itemcommentlist()\r
 654          * Show all the comments for a given item\r
 655          * \r
 656          * @param       integer $itemid ID for item\r
 657          * @return      void\r
 658          */\r
 659         static private function action_itemcommentlist($itemid = '')\r
 660         {\r
 661                 global $member, $manager, $CONF;\r
 662                 \r
 663                 if ( $itemid == '' )\r
 664                 {\r
 665                         $itemid = intRequestVar('itemid');\r
 666                 }\r
 667                 \r
 668                 /* TODO: we consider to use the other way insterad of this */\r
 669                 $_REQUEST['itemid'] = $itemid;\r
 670                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 671                 \r
 672                 // only allow if user is allowed to alter item\r
 673                 $member->canAlterItem($itemid) or self::disallow();\r
 674                 \r
 675                 $blogid = getBlogIdFromItemId($itemid);\r
 676                 \r
 677                 self::$skin->parse('itemcommentlist');\r
 678                 return;\r
 679         }\r
 680         \r
 681         /**\r
 682          * Admin::action_browseowncomments()\r
 683          * Browse own comments\r
 684          * \r
 685          * @param       void\r
 686          * @return      void\r
 687          */\r
 688         static private function action_browseowncomments()\r
 689         {\r
 690                 self::$skin->parse('browseowncomments');\r
 691                 return;\r
 692         }\r
 693         \r
 694         /**\r
 695          * Admin::action_blogcommentlist()\r
 696          * Browse all comments for a weblog\r
 697          * \r
 698          * @param       integer $blogid ID for weblog\r
 699          * @return      void\r
 700          */\r
 701         static private function action_blogcommentlist($blogid = '')\r
 702         {\r
 703                 global $member, $manager, $CONF;\r
 704                 \r
 705                 if ( $blogid == '' )\r
 706                 {\r
 707                         $blogid = intRequestVar('blogid');\r
 708                 }\r
 709                 else\r
 710                 {\r
 711                         $blogid = intval($blogid);\r
 712                 }\r
 713                 \r
 714                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 715                 \r
 716                 /* TODO: we consider to use the other way insterad of this */\r
 717                 $_REQUEST['blogid'] = $blogid;\r
 718                 \r
 719                 self::$skin->parse('blogcommentlist');\r
 720                 return;\r
 721         }\r
 722         \r
 723         /**\r
 724          * Admin::action_createitem()\r
 725          * Provide a page to item a new item to the given blog\r
 726          * \r
 727          * @param       void\r
 728          * @return      void\r
 729          */\r
 730         static private function action_createitem()\r
 731         {\r
 732                 global $member, $manager;\r
 733                 \r
 734                 $blogid = intRequestVar('blogid');\r
 735                 \r
 736                 // check if allowed\r
 737                 $member->teamRights($blogid) or self::disallow();\r
 738                 \r
 739                 $blog =& $manager->getBlog($blogid);\r
 740                 $item = array();\r
 741                 \r
 742                 $data = array(\r
 743                         'blog'          => &$blog,\r
 744                         'item'          => &$item,\r
 745                         'contents'      => &$item\r
 746                 );\r
 747                 $manager->notify('PreAddItemForm', $data);\r
 748                 \r
 749                 if ( $blog->convertBreaks() )\r
 750                 {\r
 751                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 752                         {\r
 753                                 $item['body'] = removeBreaks($item['body']);\r
 754                         }\r
 755                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 756                         {\r
 757                                 $item['more'] = removeBreaks($item['more']);\r
 758                         }\r
 759                 }\r
 760                 \r
 761                 self::$blog = &$blog;\r
 762                 self::$item = &$item;\r
 763                 \r
 764                 self::$skin->parse('createitem');\r
 765                 return;\r
 766         }\r
 767         \r
 768         /**\r
 769          * Admin::action_itemedit()\r
 770          * \r
 771          * @param       void\r
 772          * @return      void\r
 773          */\r
 774         static private function action_itemedit()\r
 775         {\r
 776                 global $member, $manager;\r
 777                 \r
 778                 $itemid = intRequestVar('itemid');\r
 779                 \r
 780                 // only allow if user is allowed to alter item\r
 781                 $member->canAlterItem($itemid) or self::disallow();\r
 782                 \r
 783                 $blogid = getBlogIDFromItemID($itemid);\r
 784                 $blog =& $manager->getBlog($blogid);\r
 785                 \r
 786                 $item =& $manager->getItem($itemid, 1, 1);\r
 787                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 788                 \r
 789                 if ( $blog->convertBreaks() )\r
 790                 {\r
 791                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 792                         {\r
 793                                 $item['body'] = removeBreaks($item['body']);\r
 794                         }\r
 795                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 796                         {\r
 797                                 $item['more'] = removeBreaks($item['more']);\r
 798                         }\r
 799                 }\r
 800                 \r
 801                 self::$blog = &$blog;\r
 802                 self::$item = &$item;\r
 803                 \r
 804                 self::$skin->parse('itemedit');\r
 805                 return;\r
 806         }\r
 807         \r
 808         /**\r
 809          * Admin::action_itemupdate()\r
 810          * \r
 811          * @param       void\r
 812          * @return      void\r
 813          */\r
 814         static private function action_itemupdate()\r
 815         {\r
 816                 global $member, $manager, $CONF;\r
 817                 \r
 818                 $itemid = intRequestVar('itemid');\r
 819                 $catid  = postVar('catid');\r
 820                 \r
 821                 // only allow if user is allowed to alter item\r
 822                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 823                 \r
 824                 $actiontype = postVar('actiontype');\r
 825                 \r
 826                 // delete actions are handled by itemdelete (which has confirmation)\r
 827                 if ( $actiontype == 'delete' )\r
 828                 {\r
 829                         self::action_itemdelete();\r
 830                         return;\r
 831                 }\r
 832                 \r
 833                 $body           = postVar('body');\r
 834                 $title          = postVar('title');\r
 835                 $more           = postVar('more');\r
 836                 $closed         = intPostVar('closed');\r
 837                 $draftid        = intPostVar('draftid');\r
 838                 \r
 839                 // default action = add now\r
 840                 if ( !$actiontype )\r
 841                 {\r
 842                         $actiontype='addnow';\r
 843                 }\r
 844                 \r
 845                 // create new category if needed\r
 846                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 847                 {\r
 848                         // get blogid\r
 849                         list($blogid) = sscanf($catid,"newcat-%d");\r
 850                         \r
 851                         // create\r
 852                         $blog =& $manager->getBlog($blogid);\r
 853                         $catid = $blog->createNewCategory();\r
 854                         \r
 855                         // show error when sth goes wrong\r
 856                         if ( !$catid )\r
 857                         {\r
 858                                 self::doError(_ERROR_CATCREATEFAIL);\r
 859                         }\r
 860                 }\r
 861                 \r
 862                 /*\r
 863                         set some variables based on actiontype\r
 864 \r
 865                         actiontypes:\r
 866                                 draft items -> addnow, addfuture, adddraft, delete\r
 867                                 non-draft items -> edit, changedate, delete\r
 868 \r
 869                         variables set:\r
 870                                 $timestamp: set to a nonzero value for future dates or date changes\r
 871                                 $wasdraft: set to 1 when the item used to be a draft item\r
 872                                 $publish: set to 1 when the edited item is not a draft\r
 873          */\r
 874                 $blogid =  getBlogIDFromItemID($itemid);\r
 875                 $blog   =& $manager->getBlog($blogid);\r
 876                 \r
 877                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 878                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 879                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 880                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 881                 {\r
 882                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 883                 }\r
 884                 else\r
 885                 {\r
 886                         $timestamp =0;\r
 887                 }\r
 888                 \r
 889                 // edit the item for real\r
 890                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 891                 \r
 892                 self::updateFuturePosted($blogid);\r
 893                 \r
 894                 if ( $draftid > 0 )\r
 895                 {\r
 896                         // delete permission is checked inside Item::delete()\r
 897                         Item::delete($draftid);\r
 898                 }\r
 899                 \r
 900                 if ( $catid != intPostVar('catid') )\r
 901                 {\r
 902                         self::action_categoryedit(\r
 903                                 $catid,\r
 904                                 $blog->getID(),\r
 905                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 906                         );\r
 907                 }\r
 908                 else\r
 909                 {\r
 910                         // TODO: set start item correctly for itemlist\r
 911                         $item = Item::getItem($itemid, 0, 0);\r
 912                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 913                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 914                         $cnt  = DB::getValue($query);\r
 915                         $_REQUEST['start'] = $cnt + 1;\r
 916                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 917                 }\r
 918                 return;\r
 919         }\r
 920         \r
 921         /**\r
 922          * Admin::action_itemdelete()\r
 923          * Delete item\r
 924          * \r
 925          * @param       Void\r
 926          * @return      Void\r
 927          */\r
 928         static private function action_itemdelete()\r
 929         {\r
 930                 global $member, $manager;\r
 931                 \r
 932                 $itemid = intRequestVar('itemid');\r
 933                 \r
 934                 // only allow if user is allowed to alter item\r
 935                 $member->canAlterItem($itemid) or self::disallow();\r
 936                 \r
 937                 if ( !$manager->existsItem($itemid,1,1) )\r
 938                 {\r
 939                         self::error(_ERROR_NOSUCHITEM);\r
 940                 }\r
 941                 \r
 942                 self::$skin->parse('itemdelete');\r
 943                 return;\r
 944         }\r
 945         \r
 946         /**\r
 947          * Admin::action_itemdeleteconfirm()\r
 948          * \r
 949          * @param       void\r
 950          * @return      void\r
 951          */\r
 952         static private function action_itemdeleteconfirm()\r
 953         {\r
 954                 global $member;\r
 955                 \r
 956                 $itemid = intRequestVar('itemid');\r
 957                 \r
 958                 // only allow if user is allowed to alter item\r
 959                 $member->canAlterItem($itemid) or self::disallow();\r
 960                 \r
 961                 // get blogid first\r
 962                 $blogid = getBlogIdFromItemId($itemid);\r
 963                 \r
 964                 // delete item (note: some checks will be performed twice)\r
 965                 self::deleteOneItem($itemid);\r
 966                 \r
 967                 self::action_itemlist($blogid);\r
 968                 return;\r
 969         }\r
 970         \r
 971         /**\r
 972          * Admin::deleteOneItem()\r
 973          * Deletes one item and returns error if something goes wrong\r
 974          * \r
 975          * @param       integer $itemid ID for item\r
 976          * @return      void\r
 977          */\r
 978         static public function deleteOneItem($itemid)\r
 979         {\r
 980                 global $member, $manager;\r
 981                 \r
 982                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
 983                 if ( !$member->canAlterItem($itemid) )\r
 984                 {\r
 985                         return _ERROR_DISALLOWED;\r
 986                 }\r
 987                 \r
 988                 // need to get blogid before the item is deleted\r
 989                 $blogid = getBlogIDFromItemId($itemid);\r
 990                 \r
 991                 $manager->loadClass('ITEM');\r
 992                 Item::delete($itemid);\r
 993                 \r
 994                 // update blog's futureposted\r
 995                 self::updateFuturePosted($blogid);\r
 996                 return;\r
 997         }\r
 998         \r
 999         /**\r
1000          * Admin::updateFuturePosted()\r
1001          * Update a blog's future posted flag\r
1002          * \r
1003          * @param integer $blogid\r
1004          * @return      void\r
1005          */\r
1006         static private function updateFuturePosted($blogid)\r
1007         {\r
1008                 global $manager;\r
1009                 \r
1010                 $blogid                 =  intval($blogid);\r
1011                 $blog                   =& $manager->getBlog($blogid);\r
1012                 $currenttime    =  $blog->getCorrectTime(time());\r
1013                 \r
1014                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1015                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1016                 $result = DB::getResult($query);\r
1017                 \r
1018                 if ( $result->rowCount() > 0 )\r
1019                 {\r
1020                                 $blog->setFuturePost();\r
1021                 }\r
1022                 else\r
1023                 {\r
1024                                 $blog->clearFuturePost();\r
1025                 }\r
1026                 return;\r
1027         }\r
1028 \r
1029         /**\r
1030          * Admin::action_itemmove()\r
1031          * \r
1032          * @param       void\r
1033          * @return      void\r
1034          */\r
1035         static private function action_itemmove()\r
1036         {\r
1037                 global $member, $manager;\r
1038                 \r
1039                 $itemid = intRequestVar('itemid');\r
1040                 \r
1041                 $member->canAlterItem($itemid) or self::disallow();\r
1042                 \r
1043                 self::$skin->parse('itemmove');\r
1044                 return;\r
1045         }\r
1046         \r
1047         /**\r
1048          * Admin::action_itemmoveto()\r
1049          * \r
1050          * @param       void\r
1051          * @return      void\r
1052          */\r
1053         static private function action_itemmoveto()\r
1054         {\r
1055                 global $member, $manager;\r
1056                 \r
1057                 $itemid = intRequestVar('itemid');\r
1058                 $catid = requestVar('catid');\r
1059                 \r
1060                 // create new category if needed\r
1061                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1062                 {\r
1063                         // get blogid\r
1064                         list($blogid) = sscanf($catid,'newcat-%d');\r
1065                         \r
1066                         // create\r
1067                         $blog =& $manager->getBlog($blogid);\r
1068                         $catid = $blog->createNewCategory();\r
1069                         \r
1070                         // show error when sth goes wrong\r
1071                         if ( !$catid )\r
1072                         {\r
1073                                 self::doError(_ERROR_CATCREATEFAIL);\r
1074                         }\r
1075                 }\r
1076                 \r
1077                 // only allow if user is allowed to alter item\r
1078                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1079                 \r
1080                 $old_blogid = getBlogIDFromItemId($itemid);\r
1081                 \r
1082                 Item::move($itemid, $catid);\r
1083                 \r
1084                 // set the futurePosted flag on the blog\r
1085                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1086                 \r
1087                 // reset the futurePosted in case the item is moved from one blog to another\r
1088                 self::updateFuturePosted($old_blogid);\r
1089                 \r
1090                 if ( $catid != intRequestVar('catid') )\r
1091                 {\r
1092                         self::action_categoryedit($catid, $blog->getID());\r
1093                 }\r
1094                 else\r
1095                 {\r
1096                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1097                 }\r
1098                 return;\r
1099         }\r
1100         \r
1101         /**\r
1102          * Admin::moveOneItem()\r
1103          * Moves one item to a given category (category existance should be checked by caller)\r
1104          * errors are returned\r
1105          * \r
1106          * @param       integer $itemid         ID for item\r
1107          * @param       integer $destCatid      ID for category to which the item will be moved\r
1108          * @return      void\r
1109          */\r
1110         static public function moveOneItem($itemid, $destCatid)\r
1111         {\r
1112                 global $member;\r
1113                 \r
1114                 // only allow if user is allowed to move item\r
1115                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1116                 {\r
1117                         return _ERROR_DISALLOWED;\r
1118                 }\r
1119                 \r
1120                 Item::move($itemid, $destCatid);\r
1121                 return;\r
1122         }\r
1123         \r
1124         /**\r
1125          * Admin::action_additem()\r
1126          * Adds a item to the chosen blog\r
1127          * \r
1128          * @param       void\r
1129          * @return      void\r
1130          */\r
1131         static private function action_additem()\r
1132         {\r
1133                 global $manager, $CONF;\r
1134                 \r
1135                 $manager->loadClass('ITEM');\r
1136                 \r
1137                 $result = Item::createFromRequest();\r
1138                 \r
1139                 if ( $result['status'] == 'error' )\r
1140                 {\r
1141                         self::error($result['message']);\r
1142                 }\r
1143                 \r
1144                 $itemid = (integer) $result['itemid'];\r
1145                 \r
1146                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1147                 \r
1148                 if ( $result['status'] == 'newcategory' )\r
1149                 {\r
1150                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1151                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1152                 }\r
1153                 else\r
1154                 {\r
1155                         $methodName = 'action_itemlist';\r
1156                         self::action_itemlist($blogid);\r
1157                 }\r
1158                 return;\r
1159         }\r
1160         \r
1161         /**\r
1162          * Admin::action_commentedit()\r
1163          * Allows to edit previously made comments\r
1164          * \r
1165          * @param       void\r
1166          * @return      void\r
1167          */\r
1168         static private function action_commentedit()\r
1169         {\r
1170                 global $member, $manager;\r
1171                 \r
1172                 $commentid = intRequestVar('commentid');\r
1173                 \r
1174                 $member->canAlterComment($commentid) or self::disallow();\r
1175                 \r
1176                 self::$skin->parse('commentedit');\r
1177                 return;\r
1178         }\r
1179         \r
1180         /**\r
1181          * Admin::action_commentupdate()\r
1182          * \r
1183          * @param       void\r
1184          * @return      void\r
1185          */\r
1186         static private function action_commentupdate()\r
1187         {\r
1188                 global $member, $manager;\r
1189                 \r
1190                 $commentid = intRequestVar('commentid');\r
1191                 \r
1192                 $member->canAlterComment($commentid) or self::disallow();\r
1193                 \r
1194                 $url    = postVar('url');\r
1195                 $email  = postVar('email');\r
1196                 $body   = postVar('body');\r
1197                 \r
1198                 // intercept words that are too long\r
1199                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1200                 {\r
1201                         self::error(_ERROR_COMMENT_LONGWORD);\r
1202                 }\r
1203                 \r
1204                 // check length\r
1205                 if ( i18n::strlen($body) < 3 )\r
1206                 {\r
1207                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1208                 }\r
1209                 \r
1210                 if ( i18n::strlen($body) > 5000 )\r
1211                 {\r
1212                         self::error(_ERROR_COMMENT_TOOLONG);\r
1213                 }\r
1214                 \r
1215                 // prepare body\r
1216                 $body = Comment::prepareBody($body);\r
1217                 \r
1218                 // call plugins\r
1219                 $data = array(\r
1220                         'body' => &$body\r
1221                 );\r
1222                 $manager->notify('PreUpdateComment', $data);\r
1223                 \r
1224                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1225                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1226                 DB::execute($query);\r
1227                 \r
1228                 // get itemid\r
1229                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1230                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1231                 \r
1232                 $itemid = DB::getValue($query);\r
1233                 \r
1234                 if ( $member->canAlterItem($itemid) )\r
1235                 {\r
1236                         self::action_itemcommentlist($itemid);\r
1237                 }\r
1238                 else\r
1239                 {\r
1240                         self::action_browseowncomments();\r
1241                 }\r
1242                 return;\r
1243         }\r
1244         \r
1245         /**\r
1246          * Admin::action_commentdelete()\r
1247          * Update comment\r
1248          * \r
1249          * @param       void\r
1250          * @return      void\r
1251          */\r
1252         static private function action_commentdelete()\r
1253         {\r
1254                 global $member, $manager;\r
1255                 \r
1256                 $commentid = intRequestVar('commentid');\r
1257                 $member->canAlterComment($commentid) or self::disallow();\r
1258                 \r
1259                 self::$skin->parse('commentdelete');\r
1260                 return;\r
1261         }\r
1262         \r
1263         /**\r
1264          * Admin::action_commentdeleteconfirm()\r
1265          * \r
1266          * @param       void\r
1267          * @return      void\r
1268          */\r
1269         static private function action_commentdeleteconfirm()\r
1270         {\r
1271                 global $member;\r
1272                 \r
1273                 $commentid = intRequestVar('commentid');\r
1274                 \r
1275                 // get item id first\r
1276                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1277                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1278                 \r
1279                 $itemid = DB::getValue($query);\r
1280                 \r
1281                 $error = self::deleteOneComment($commentid);\r
1282                 if ( $error )\r
1283                 {\r
1284                         self::doError($error);\r
1285                 }\r
1286                 \r
1287                 if ( $member->canAlterItem($itemid) )\r
1288                 {\r
1289                         self::action_itemcommentlist($itemid);\r
1290                 }\r
1291                 else\r
1292                 {\r
1293                         self::action_browseowncomments();\r
1294                 }\r
1295                 return;\r
1296         }\r
1297         \r
1298         /**\r
1299          * Admin::deleteOneComment()\r
1300          * \r
1301          * @param       integer $commentid      ID for comment\r
1302          * @return      void\r
1303          */\r
1304         static public function deleteOneComment($commentid)\r
1305         {\r
1306                 global $member, $manager;\r
1307                 \r
1308                 $commentid = (integer) $commentid;\r
1309                 \r
1310                 if ( !$member->canAlterComment($commentid) )\r
1311                 {\r
1312                         return _ERROR_DISALLOWED;\r
1313                 }\r
1314                 \r
1315                 $data = array(\r
1316                         'commentid' => $commentid\r
1317                 );\r
1318                 \r
1319                 $manager->notify('PreDeleteComment', $data);\r
1320                 \r
1321                 // delete the comments associated with the item\r
1322                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1323                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1324                 DB::execute($query);\r
1325                 \r
1326                 $data = array(\r
1327                         'commentid' => $commentid\r
1328                 );\r
1329                 \r
1330                 $manager->notify('PostDeleteComment', $data);\r
1331                 \r
1332                 return '';\r
1333         }\r
1334         \r
1335         /**\r
1336          * Admin::action_usermanagement()\r
1337          * Usermanagement main\r
1338          * \r
1339          * @param       void\r
1340          * @return      void\r
1341          */\r
1342         static private function action_usermanagement()\r
1343         {\r
1344                 global $member, $manager;\r
1345                 \r
1346                 // check if allowed\r
1347                 $member->isAdmin() or self::disallow();\r
1348                 \r
1349                 self::$skin->parse('usermanagement');\r
1350                 return;\r
1351         }\r
1352         \r
1353         /**\r
1354          * Admin::action_memberedit()\r
1355          * Edit member settings\r
1356          * \r
1357          * @param       void\r
1358          * @return      void\r
1359          */\r
1360         static private function action_memberedit()\r
1361         {\r
1362                 self::action_editmembersettings(intRequestVar('memberid'));\r
1363                 return;\r
1364         }\r
1365         \r
1366         /**\r
1367          * Admin::action_editmembersettings()\r
1368          * \r
1369          * @param       integer $memberid       ID for member\r
1370          * @return      void\r
1371          * \r
1372          */\r
1373         static private function action_editmembersettings($memberid = '')\r
1374         {\r
1375                 global $member, $manager, $CONF;\r
1376                 \r
1377                 if ( $memberid == '' )\r
1378                 {\r
1379                         $memberid = $member->getID();\r
1380                 }\r
1381                 \r
1382                 /* TODO: we should consider to use the other way insterad of this */\r
1383                 $_REQUEST['memberid'] = $memberid;\r
1384                 \r
1385                 // check if allowed\r
1386                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1387                 \r
1388                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1389                 \r
1390                 self::$skin->parse('editmembersettings');\r
1391                 return;\r
1392         }\r
1393         \r
1394         /**\r
1395          * Admin::action_changemembersettings()\r
1396          * \r
1397          * @param       void\r
1398          * @return      void\r
1399          */\r
1400         static private function action_changemembersettings()\r
1401         {\r
1402                 global $member, $CONF, $manager;\r
1403                 \r
1404                 $memberid = intRequestVar('memberid');\r
1405                 \r
1406                 // check if allowed\r
1407                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1408                 \r
1409                 $name                   = trim(strip_tags(postVar('name')));\r
1410                 $realname               = trim(strip_tags(postVar('realname')));\r
1411                 $password               = postVar('password');\r
1412                 $repeatpassword = postVar('repeatpassword');\r
1413                 $email                  = strip_tags(postVar('email'));\r
1414                 $url                    = strip_tags(postVar('url'));\r
1415                 $adminskin              = intPostVar('adminskin');\r
1416                 \r
1417                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1418                 if ( !preg_match('#^https?://#', $url) )\r
1419                 {\r
1420                         $url = 'http://' . $url;\r
1421                 }\r
1422                 \r
1423                 $admin          = postVar('admin');\r
1424                 $canlogin       = postVar('canlogin');\r
1425                 $notes          = strip_tags(postVar('notes'));\r
1426                 $locale         = postVar('locale');\r
1427                 \r
1428                 $mem = Member::createFromID($memberid);\r
1429                 \r
1430                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1431                 {\r
1432                         if ( !isValidDisplayName($name) )\r
1433                         {\r
1434                                 self::error(_ERROR_BADNAME);\r
1435                         }\r
1436                         \r
1437                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1438                         {\r
1439                                 self::error(_ERROR_NICKNAMEINUSE);\r
1440                         }\r
1441                         \r
1442                         if ( $password != $repeatpassword )\r
1443                         {\r
1444                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1445                         }\r
1446                         \r
1447                         if ( $password && (i18n::strlen($password) < 6) )\r
1448                         {\r
1449                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1450                         }\r
1451                                 \r
1452                         if ( $password )\r
1453                         {\r
1454                                 $pwdvalid = true;\r
1455                                 $pwderror = '';\r
1456                                 \r
1457                                 $data = array(\r
1458                                         'password'     => $password,\r
1459                                         'errormessage' => &$pwderror,\r
1460                                         'valid'        => &$pwdvalid\r
1461                                 );\r
1462                                 $manager->notify('PrePasswordSet', $data);\r
1463                                 \r
1464                                 if ( !$pwdvalid )\r
1465                                 {\r
1466                                         self::error($pwderror);\r
1467                                 }\r
1468                         }\r
1469                 }\r
1470                 \r
1471                 if ( !NOTIFICATION::address_validation($email) )\r
1472                 {\r
1473                         self::error(_ERROR_BADMAILADDRESS);\r
1474                 }\r
1475                 if ( !$realname )\r
1476                 {\r
1477                         self::error(_ERROR_REALNAMEMISSING);\r
1478                 }\r
1479                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1480                 {\r
1481                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1482                 }\r
1483                 \r
1484                 // check if there will remain at least one site member with both the logon and admin rights\r
1485                 // (check occurs when taking away one of these rights from such a member)\r
1486                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1487                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1488                         )\r
1489                 {\r
1490                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1491                         if ( $r->rowCount() < 2 )\r
1492                         {\r
1493                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1494                         }\r
1495                 }\r
1496                 \r
1497                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1498                 {\r
1499                         $mem->setDisplayName($name);\r
1500                         if ( $password )\r
1501                         {\r
1502                                 $mem->setPassword($password);\r
1503                         }\r
1504                 }\r
1505                 \r
1506                 $oldEmail = $mem->getEmail();\r
1507                 \r
1508                 $mem->setRealName($realname);\r
1509                 $mem->setEmail($email);\r
1510                 $mem->setURL($url);\r
1511                 $mem->setNotes($notes);\r
1512                 $mem->setLocale($locale);\r
1513                 \r
1514                 // only allow super-admins to make changes to the admin status\r
1515                 if ( $member->isAdmin() )\r
1516                 {\r
1517                         $mem->setAdmin($admin);\r
1518                         $mem->setCanLogin($canlogin);\r
1519                 }\r
1520                 \r
1521                 $autosave = postVar('autosave');\r
1522                 $mem->setAutosave($autosave);\r
1523                 \r
1524                 $mem->write();\r
1525                 \r
1526                 // store plugin options\r
1527                 $aOptions = requestArray('plugoption');\r
1528                 NucleusPlugin::apply_plugin_options($aOptions);\r
1529                 $data = array(\r
1530                         'context'  => 'member',\r
1531                         'memberid' => $memberid,\r
1532                         'member'   => &$mem\r
1533                 );\r
1534                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1535                 \r
1536                 // if email changed, generate new password\r
1537                 if ( $oldEmail != $mem->getEmail() )\r
1538                 {\r
1539                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1540                         // logout member\r
1541                         $mem->newCookieKey();\r
1542                         \r
1543                         // only log out if the member being edited is the current member.\r
1544                         if ( $member->getID() == $memberid )\r
1545                         {\r
1546                                 $member->logout();\r
1547                         }\r
1548                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1549                         return;\r
1550                 }\r
1551                 \r
1552                 if ( ($mem->getID() == $member->getID())\r
1553                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1554                 {\r
1555                         $mem->newCookieKey();\r
1556                         $member->logout();\r
1557                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1558                 }\r
1559                 else\r
1560                 {\r
1561                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1562                 }\r
1563                 return;\r
1564         }\r
1565 \r
1566         /**\r
1567          * Admin::action_memberadd()\r
1568          * \r
1569          * @param       void\r
1570          * @return      void\r
1571          * \r
1572          */\r
1573         static private function action_memberadd()\r
1574         {\r
1575                 global $member, $manager;\r
1576                 \r
1577                 // check if allowed\r
1578                 $member->isAdmin() or self::disallow();\r
1579                 \r
1580                 if ( postVar('password') != postVar('repeatpassword') )\r
1581                 {\r
1582                         self::error(_ERROR_PASSWORDMISMATCH);\r
1583                 }\r
1584                 \r
1585                 if ( i18n::strlen(postVar('password')) < 6 )\r
1586                 {\r
1587                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1588                 }\r
1589                 \r
1590                 $res = Member::create(\r
1591                         postVar('name'),\r
1592                         postVar('realname'),\r
1593                         postVar('password'),\r
1594                         postVar('email'),\r
1595                         postVar('url'),\r
1596                         postVar('admin'),\r
1597                         postVar('canlogin'),\r
1598                         postVar('notes')\r
1599                 );\r
1600                 \r
1601                 if ( $res != 1 )\r
1602                 {\r
1603                         self::error($res);\r
1604                 }\r
1605                 \r
1606                 // fire PostRegister event\r
1607                 $newmem = new Member();\r
1608                 $newmem->readFromName(postVar('name'));\r
1609                 $data = array(\r
1610                         'member' => &$newmem\r
1611                 );\r
1612                 $manager->notify('PostRegister', $data);\r
1613                 \r
1614                 self::action_usermanagement();\r
1615                 return;\r
1616         }\r
1617         \r
1618         /**\r
1619          * Admin::action_activate()\r
1620          * Account activation\r
1621          * \r
1622          * @param       void\r
1623          * @return      void\r
1624          */\r
1625         static private function action_activate()\r
1626         {\r
1627                 $key = getVar('key');\r
1628                 self::showActivationPage($key);\r
1629                 return;\r
1630         }\r
1631         \r
1632         /**\r
1633          * Admin::showActivationPage()\r
1634          * \r
1635          * @param       void\r
1636          * @return      void\r
1637          */\r
1638         static private function showActivationPage($key, $message = '')\r
1639         {\r
1640                 global $manager;\r
1641                 \r
1642                 // clean up old activation keys\r
1643                 Member::cleanupActivationTable();\r
1644                 \r
1645                 // get activation info\r
1646                 $info = Member::getActivationInfo($key);\r
1647                 \r
1648                 if ( !$info )\r
1649                 {\r
1650                         self::error(_ERROR_ACTIVATE);\r
1651                 }\r
1652                 \r
1653                 $mem = Member::createFromId($info->vmember);\r
1654                 \r
1655                 if ( !$mem )\r
1656                 {\r
1657                         self::error(_ERROR_ACTIVATE);\r
1658                 }\r
1659                 \r
1660                 /* TODO: we should consider to use the other way insterad of this */\r
1661                 $_POST['ackey']                                 = $key;\r
1662                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1663                 \r
1664                 self::$headMess = $message;\r
1665                 self::$skin->parse('activate');\r
1666                 return;\r
1667         }\r
1668         \r
1669         /**\r
1670          * Admin::action_activatesetpwd()\r
1671          * Account activation - set password part\r
1672          * \r
1673          * @param       void\r
1674          * @return      void\r
1675          */\r
1676         static private function action_activatesetpwd()\r
1677         {\r
1678                 global $manager;\r
1679                 $key = postVar('key');\r
1680                 \r
1681                 // clean up old activation keys\r
1682                 Member::cleanupActivationTable();\r
1683                 \r
1684                 // get activation info\r
1685                 $info = Member::getActivationInfo($key);\r
1686                 \r
1687                 if ( !$info || ($info->type == 'addresschange') )\r
1688                 {\r
1689                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1690                 }\r
1691                 \r
1692                 $mem = Member::createFromId($info->vmember);\r
1693                 \r
1694                 if ( !$mem )\r
1695                 {\r
1696                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1697                 }\r
1698                 \r
1699                 $password               = postVar('password');\r
1700                 $repeatpassword = postVar('repeatpassword');\r
1701                 \r
1702                 if ( $password != $repeatpassword )\r
1703                 {\r
1704                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1705                 }\r
1706                 \r
1707                 if ( $password && (i18n::strlen($password) < 6) )\r
1708                 {\r
1709                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1710                 }\r
1711                         \r
1712                 if ( $password )\r
1713                 {\r
1714                         $pwdvalid = true;\r
1715                         $pwderror = '';\r
1716                         \r
1717                         $data = array(\r
1718                                 'password'              => $password,\r
1719                                 'errormessage'  => &$pwderror,\r
1720                                 'valid'                 => &$pwdvalid\r
1721                         );\r
1722                         $manager->notify('PrePasswordSet', $data);\r
1723                         if ( !$pwdvalid )\r
1724                         {\r
1725                                 return self::showActivationPage($key,$pwderror);\r
1726                         }\r
1727                 }\r
1728                 \r
1729                 $error = '';\r
1730                 \r
1731                 $data = array(\r
1732                         'type'   => 'activation',\r
1733                         'member' => $mem,\r
1734                         'error'  => &$error\r
1735                 );\r
1736                 $manager->notify('ValidateForm', $data);\r
1737                 if ( $error != '' )\r
1738                 {\r
1739                         return self::showActivationPage($key, $error);\r
1740                 }\r
1741                 \r
1742                 // set password\r
1743                 $mem->setPassword($password);\r
1744                 $mem->write();\r
1745                 \r
1746                 // do the activation\r
1747                 Member::activate($key);\r
1748                 \r
1749                 self::$skin->parse('activatesetpwd');\r
1750                 return;\r
1751         }\r
1752         \r
1753         /**\r
1754          * Admin::action_manageteam()\r
1755          * Manage team\r
1756          * \r
1757          * @param       void\r
1758          * @return      void\r
1759          */\r
1760         static private function action_manageteam()\r
1761         {\r
1762                 global $member, $manager;\r
1763                 \r
1764                 $blogid = intRequestVar('blogid');\r
1765                 \r
1766                 // check if allowed\r
1767                 $member->blogAdminRights($blogid) or self::disallow();\r
1768                 \r
1769                 self::$skin->parse('manageteam');\r
1770                 return;\r
1771         }\r
1772         \r
1773         /**\r
1774          * Admin::action_teamaddmember()\r
1775          * Add member to team\r
1776          * \r
1777          * @param       void\r
1778          * @return      void\r
1779          */\r
1780         static private function action_teamaddmember()\r
1781         {\r
1782                 global $member, $manager;\r
1783                 \r
1784                 $memberid       = intPostVar('memberid');\r
1785                 $blogid         = intPostVar('blogid');\r
1786                 $admin          = intPostVar('admin');\r
1787                 \r
1788                 // check if allowed\r
1789                 $member->blogAdminRights($blogid) or self::disallow();\r
1790                 \r
1791                 $blog =& $manager->getBlog($blogid);\r
1792                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1793                 {\r
1794                         self::error(_ERROR_ALREADYONTEAM);\r
1795                 }\r
1796                 \r
1797                 self::action_manageteam();\r
1798                 return;\r
1799         }\r
1800         \r
1801         /**\r
1802          * Admin::action_teamdelete()\r
1803          * \r
1804          * @param       void\r
1805          * @return      void\r
1806          */\r
1807         static private function action_teamdelete()\r
1808         {\r
1809                 global $member, $manager;\r
1810                 \r
1811                 $memberid       = intRequestVar('memberid');\r
1812                 $blogid         = intRequestVar('blogid');\r
1813                 \r
1814                 // check if allowed\r
1815                 $member->blogAdminRights($blogid) or self::disallow();\r
1816                 \r
1817                 $teammem =  Member::createFromID($memberid);\r
1818                 $blog =& $manager->getBlog($blogid);\r
1819                 \r
1820                 self::$skin->parse('teamdelete');\r
1821                 return;\r
1822         }\r
1823         \r
1824         /**\r
1825          * Admin::action_teamdeleteconfirm()\r
1826          * \r
1827          * @param       void\r
1828          * @return      void\r
1829          */\r
1830         static private function action_teamdeleteconfirm()\r
1831         {\r
1832                 global $member;\r
1833                 \r
1834                 $memberid = intRequestVar('memberid');\r
1835                 $blogid = intRequestVar('blogid');\r
1836                 \r
1837                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1838                 if ( $error )\r
1839                 {\r
1840                         self::error($error);\r
1841                 }\r
1842                 self::action_manageteam();\r
1843                 return;\r
1844         }\r
1845         \r
1846         /**\r
1847          * Admin::deleteOneTeamMember()\r
1848          * \r
1849          * @param       void\r
1850          * @return      void\r
1851          */\r
1852         static public function deleteOneTeamMember($blogid, $memberid)\r
1853         {\r
1854                 global $member, $manager;\r
1855                 \r
1856                 $blogid   = intval($blogid);\r
1857                 $memberid = intval($memberid);\r
1858                 \r
1859                 // check if allowed\r
1860                 if ( !$member->blogAdminRights($blogid) )\r
1861                 {\r
1862                         return _ERROR_DISALLOWED;\r
1863                 }\r
1864                 \r
1865                 // check if: - there remains at least one blog admin\r
1866                 //           - (there remains at least one team member)\r
1867                 $tmem = Member::createFromID($memberid);\r
1868                 \r
1869                 \r
1870                 $data = array(\r
1871                         'member' => &$tmem,\r
1872                         'blogid' => $blogid\r
1873                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1874                 \r
1875                 if ( $tmem->isBlogAdmin($blogid) )\r
1876                 {\r
1877                         /* TODO: why we did double check? */\r
1878                         // check if there are more blog members left and at least one admin\r
1879                         // (check for at least two admins before deletion)\r
1880                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1881                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1882                         $r     = DB::getResult($query);\r
1883                         if ( $r->rowCount() < 2 )\r
1884                         {\r
1885                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1886                         }\r
1887                 }\r
1888                 \r
1889                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1890                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1891                 DB::execute($query);\r
1892                 \r
1893                 $data = array(\r
1894                         'member' => &$tmem,\r
1895                         'blogid' => $blogid\r
1896                 );\r
1897                 $manager->notify('PostDeleteTeamMember', $data);\r
1898                 \r
1899                 return '';\r
1900         }\r
1901         \r
1902         /**\r
1903          * Admin::action_teamchangeadmin()\r
1904          * \r
1905          * @param       void\r
1906          * @return      void\r
1907          */\r
1908         static private function action_teamchangeadmin()\r
1909         {\r
1910                 global $member;\r
1911                 \r
1912                 $blogid         = intRequestVar('blogid');\r
1913                 $memberid       = intRequestVar('memberid');\r
1914                 \r
1915                 // check if allowed\r
1916                 $member->blogAdminRights($blogid) or self::disallow();\r
1917                 \r
1918                 $mem = Member::createFromID($memberid);\r
1919                 \r
1920                 // don't allow when there is only one admin at this moment\r
1921                 if ( $mem->isBlogAdmin($blogid) )\r
1922                 {\r
1923                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1924                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1925                         $r = DB::getResult($query);\r
1926                         if ( $r->rowCount() == 1 )\r
1927                         {\r
1928                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
1929                         }\r
1930                 }\r
1931                 \r
1932                 if ( $mem->isBlogAdmin($blogid) )\r
1933                 {\r
1934                         $newval = 0;\r
1935                 }\r
1936                 else\r
1937                 {\r
1938                         $newval = 1;\r
1939                 }\r
1940                 \r
1941                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
1942                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
1943                 DB::execute($query);\r
1944                 \r
1945                 // only show manageteam if member did not change its own admin privileges\r
1946                 if ( $member->isBlogAdmin($blogid) )\r
1947                 {\r
1948                         self::action_manageteam();\r
1949                 }\r
1950                 else\r
1951                 {\r
1952                         self::action_overview(_MSG_ADMINCHANGED);\r
1953                 }\r
1954                 return;\r
1955         }\r
1956         \r
1957         /**\r
1958          * Admin::action_blogsettings()\r
1959          * \r
1960          * @param       void\r
1961          * @return      void\r
1962          */\r
1963         static private function action_blogsettings()\r
1964         {\r
1965                 global $member, $manager;\r
1966                 \r
1967                 $blogid = intRequestVar('blogid');\r
1968                 \r
1969                 // check if allowed\r
1970                 $member->blogAdminRights($blogid) or self::disallow();\r
1971                 \r
1972                 $blog =& $manager->getBlog($blogid);\r
1973                 \r
1974                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1975                 \r
1976                 self::$skin->parse('blogsettings');\r
1977                 return;\r
1978         }\r
1979         \r
1980         /**\r
1981          * Admin::action_categorynew()\r
1982          * \r
1983          * @param       void\r
1984          * @return      void\r
1985          */\r
1986         static private function action_categorynew()\r
1987         {\r
1988                 global $member, $manager;\r
1989                 \r
1990                 $blogid = intRequestVar('blogid');\r
1991                 \r
1992                 $member->blogAdminRights($blogid) or self::disallow();\r
1993                 \r
1994                 $cname = postVar('cname');\r
1995                 $cdesc = postVar('cdesc');\r
1996                 \r
1997                 if ( !isValidCategoryName($cname) )\r
1998                 {\r
1999                         self::error(_ERROR_BADCATEGORYNAME);\r
2000                 }\r
2001                 \r
2002                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2003                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2004                 $res = DB::getResult($query);\r
2005                 if ( $res->rowCount() > 0 )\r
2006                 {\r
2007                         self::error(_ERROR_DUPCATEGORYNAME);\r
2008                 }\r
2009                 \r
2010                 $blog           =& $manager->getBlog($blogid);\r
2011                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2012                 \r
2013                 self::action_blogsettings();\r
2014                 return;\r
2015         }\r
2016         \r
2017         /**\r
2018          * Admin::action_categoryedit()\r
2019          * \r
2020          * @param       void\r
2021          * @return      void\r
2022          */\r
2023         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2024         {\r
2025                 global $member, $manager;\r
2026                 \r
2027                 if ( $blogid == '' )\r
2028                 {\r
2029                         $blogid = intGetVar('blogid');\r
2030                 }\r
2031                 else\r
2032                 {\r
2033                         $blogid = intval($blogid);\r
2034                 }\r
2035                 if ( $catid == '' )\r
2036                 {\r
2037                         $catid = intGetVar('catid');\r
2038                 }\r
2039                 else\r
2040                 {\r
2041                         $catid = intval($catid);\r
2042                 }\r
2043                 \r
2044                 /* TODO: we should consider to use the other way insterad of this */\r
2045                 $_REQUEST['blogid']             = $blogid;\r
2046                 $_REQUEST['catid']              = $catid;\r
2047                 $_REQUEST['desturl']    = $desturl;\r
2048                 $member->blogAdminRights($blogid) or self::disallow();\r
2049                 \r
2050                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2051                 \r
2052                 self::$skin->parse('categoryedit');\r
2053                 return;\r
2054         }\r
2055         \r
2056         /**\r
2057          * Admin::action_categoryupdate()\r
2058          * \r
2059          * @param       void\r
2060          * @return      void\r
2061          */\r
2062         static private function action_categoryupdate()\r
2063         {\r
2064                 global $member, $manager;\r
2065                 \r
2066                 $blogid         = intPostVar('blogid');\r
2067                 $catid          = intPostVar('catid');\r
2068                 $cname          = postVar('cname');\r
2069                 $cdesc          = postVar('cdesc');\r
2070                 $desturl        = postVar('desturl');\r
2071                 \r
2072                 $member->blogAdminRights($blogid) or self::disallow();\r
2073                 \r
2074                 if ( !isValidCategoryName($cname) )\r
2075                 {\r
2076                         self::error(_ERROR_BADCATEGORYNAME);\r
2077                 }\r
2078                 \r
2079                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2080                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2081                 $res    = DB::getResult($query);\r
2082                 if ( $res->rowCount() > 0 )\r
2083                 {\r
2084                         self::error(_ERROR_DUPCATEGORYNAME);\r
2085                 }\r
2086                 \r
2087                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2088                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2089                 DB::execute($query);\r
2090                 \r
2091                 // store plugin options\r
2092                 $aOptions = requestArray('plugoption');\r
2093                 NucleusPlugin::apply_plugin_options($aOptions);\r
2094                 $data = array(\r
2095                         'context'       => 'category',\r
2096                         'catid'         => $catid\r
2097                 );\r
2098                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2099                 \r
2100                 if ( $desturl )\r
2101                 {\r
2102                         redirect($desturl);\r
2103                         exit;\r
2104                 }\r
2105                 else\r
2106                 {\r
2107                         self::action_blogsettings();\r
2108                 }\r
2109                 return;\r
2110         }\r
2111         \r
2112         /**\r
2113          * Admin::action_categorydelete()\r
2114          * \r
2115          * @param       void\r
2116          * @return      void\r
2117          */\r
2118         static private function action_categorydelete()\r
2119         {\r
2120                 global $member, $manager;\r
2121                 \r
2122                 $blogid = intRequestVar('blogid');\r
2123                 $catid  = intRequestVar('catid');\r
2124                 \r
2125                 $member->blogAdminRights($blogid) or self::disallow();\r
2126                 \r
2127                 $blog =& $manager->getBlog($blogid);\r
2128                 \r
2129                 // check if the category is valid\r
2130                 if ( !$blog->isValidCategory($catid) )\r
2131                 {\r
2132                         self::error(_ERROR_NOSUCHCATEGORY);\r
2133                 }\r
2134                 \r
2135                 // don't allow deletion of default category\r
2136                 if ( $blog->getDefaultCategory() == $catid )\r
2137                 {\r
2138                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2139                 }\r
2140                 \r
2141                 // check if catid is the only category left for blogid\r
2142                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2143                 $query = sprintf($query, sql_table('category'), $blogid);\r
2144                 $res = DB::getResult($query);\r
2145                 if ( $res->rowCount() == 1 )\r
2146                 {\r
2147                         self::error(_ERROR_DELETELASTCATEGORY);\r
2148                 }\r
2149                 \r
2150                 self::$skin->parse('categorydelete');\r
2151                 return;\r
2152         }\r
2153         \r
2154         /**\r
2155          * Admin::action_categorydeleteconfirm()\r
2156          * \r
2157          * @param       void\r
2158          * @return      void\r
2159          */\r
2160         static private function action_categorydeleteconfirm()\r
2161         {\r
2162                 global $member, $manager;\r
2163                 \r
2164                 $blogid = intRequestVar('blogid');\r
2165                 $catid  = intRequestVar('catid');\r
2166                 \r
2167                 $member->blogAdminRights($blogid) or self::disallow();\r
2168                 \r
2169                 $error = self::deleteOneCategory($catid);\r
2170                 if ( $error )\r
2171                 {\r
2172                         self::error($error);\r
2173                 }\r
2174                 \r
2175                 self::action_blogsettings();\r
2176                 return;\r
2177         }\r
2178         \r
2179         /**\r
2180          * Admin::deleteOneCategory()\r
2181          * Delete a category by its id\r
2182          * \r
2183          * @param       String  $catid  category id for deleting\r
2184          * @return      Void\r
2185          */\r
2186         static public function deleteOneCategory($catid)\r
2187         {\r
2188                 global $manager, $member;\r
2189                 \r
2190                 $catid  = intval($catid);\r
2191                 $blogid = getBlogIDFromCatID($catid);\r
2192                 \r
2193                 if ( !$member->blogAdminRights($blogid) )\r
2194                 {\r
2195                         return ERROR_DISALLOWED;\r
2196                 }\r
2197                 \r
2198                 // get blog\r
2199                 $blog =& $manager->getBlog($blogid);\r
2200                 \r
2201                 // check if the category is valid\r
2202                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2203                 {\r
2204                         return _ERROR_NOSUCHCATEGORY;\r
2205                 }\r
2206                 \r
2207                 $destcatid = $blog->getDefaultCategory();\r
2208                 \r
2209                 // don't allow deletion of default category\r
2210                 if ( $blog->getDefaultCategory() == $catid )\r
2211                 {\r
2212                         return _ERROR_DELETEDEFCATEGORY;\r
2213                 }\r
2214                 \r
2215                 // check if catid is the only category left for blogid\r
2216                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2217                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2218                 \r
2219                 $res = DB::getResult($query);\r
2220                 if ( $res->rowCount() == 1 )\r
2221                 {\r
2222                         return _ERROR_DELETELASTCATEGORY;\r
2223                 }\r
2224                 \r
2225                 $data = array('catid' => $catid);\r
2226                 $manager->notify('PreDeleteCategory', $data);\r
2227                 \r
2228                 // change category for all items to the default category\r
2229                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2230                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2231                 DB::execute($query);\r
2232                 \r
2233                 // delete all associated plugin options\r
2234                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2235                 \r
2236                 // delete category\r
2237                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2238                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2239                 DB::execute($query);\r
2240                 \r
2241                 $data = array('catid' => $catid);\r
2242                 $manager->notify('PostDeleteCategory', $data);\r
2243                 return;\r
2244         }\r
2245         \r
2246         /**\r
2247          * Admin::moveOneCategory()\r
2248          * Delete a category by its id\r
2249          * \r
2250          * @param       int     $catid          category id for move\r
2251          * @param       int     $destblogid     blog id for destination\r
2252          * @return      void\r
2253          */\r
2254         static public function moveOneCategory($catid, $destblogid)\r
2255         {\r
2256                 global $manager, $member;\r
2257                 $catid      = intval($catid);\r
2258                 $destblogid = intval($destblogid);\r
2259                 $blogid     = getBlogIDFromCatID($catid);\r
2260                 // mover should have admin rights on both blogs\r
2261                 if (!$member->blogAdminRights($blogid)) {\r
2262                         return _ERROR_DISALLOWED;\r
2263                 }\r
2264                 if (!$member->blogAdminRights($destblogid)) {\r
2265                         return _ERROR_DISALLOWED;\r
2266                 }\r
2267                 // cannot move to self\r
2268                 if ($blogid == $destblogid) {\r
2269                         return _ERROR_MOVETOSELF;\r
2270                 }\r
2271                 // get blogs\r
2272                 $blog     =& $manager->getBlog($blogid);\r
2273                 $destblog =& $manager->getBlog($destblogid);\r
2274                 // check if the category is valid\r
2275                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2276                         return _ERROR_NOSUCHCATEGORY;\r
2277                 }\r
2278                 // don't allow default category to be moved\r
2279                 if ($blog->getDefaultCategory() == $catid) {\r
2280                         return _ERROR_MOVEDEFCATEGORY;\r
2281                 }\r
2282                 $manager->notify(\r
2283                                 'PreMoveCategory',\r
2284                                 array(\r
2285                                                 'catid'      => &$catid,\r
2286                                                 'sourceblog' => &$blog,\r
2287                                                 'destblog'   => &$destblog\r
2288                                 )\r
2289                 );\r
2290                 // update comments table (cblog)\r
2291                 $query = 'SELECT '\r
2292                 . '    inumber '\r
2293                 . 'FROM '\r
2294                 .      sql_table('item') . ' '\r
2295                 . 'WHERE '\r
2296                 . '    icat = %d';\r
2297                 $items = sql_query(sprintf($query, $catid));\r
2298                 while ($oItem = sql_fetch_object($items)) {\r
2299                         $query = 'UPDATE '\r
2300                         .      sql_table('comment') . ' '\r
2301                         . 'SET '\r
2302                         . '    cblog = %d' . ' '\r
2303                         . 'WHERE '\r
2304                         . '    citem = %d';\r
2305                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2306                 }\r
2307         \r
2308                 // update items (iblog)\r
2309                 $query = 'UPDATE '\r
2310                 .      sql_table('item') . ' '\r
2311                 . 'SET '\r
2312                 . '    iblog = %d '\r
2313                 . 'WHERE '\r
2314                 . '    icat = %d';\r
2315                 sql_query(sprintf($query, $destblogid, $catid));\r
2316         \r
2317                 // move category\r
2318                 $query = 'UPDATE '\r
2319                 .      sql_table('category') . ' '\r
2320                 . 'SET '\r
2321                 . '    cblog = %d' . ' '\r
2322                 . 'WHERE '\r
2323                 . '    catid = %d';\r
2324                 sql_query(sprintf($query, $destblogid, $catid));\r
2325                 $manager->notify(\r
2326                                 'PostMoveCategory',\r
2327                                 array(\r
2328                                                 'catid'      => &$catid,\r
2329                                                 'sourceblog' => &$blog,\r
2330                                                 'destblog'   => $destblog\r
2331                                 )\r
2332                 );\r
2333                 return;\r
2334         }\r
2335 \r
2336         /**\r
2337          * Admin::action_blogsettingsupdate\r
2338          * Updating blog settings\r
2339          * \r
2340          * @param       Void\r
2341          * @return      Void\r
2342          */\r
2343         static private function action_blogsettingsupdate()\r
2344         {\r
2345                 global $member, $manager;\r
2346                 \r
2347                 $blogid = intRequestVar('blogid');\r
2348                 \r
2349                 $member->blogAdminRights($blogid) or self::disallow();\r
2350                 \r
2351                 $blog =& $manager->getBlog($blogid);\r
2352                 \r
2353                 $notify_address = trim(postVar('notify'));\r
2354                 $shortname              = trim(postVar('shortname'));\r
2355                 $updatefile             = trim(postVar('update'));\r
2356                 \r
2357                 $notifyComment  = intPostVar('notifyComment');\r
2358                 $notifyVote             = intPostVar('notifyVote');\r
2359                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2360                 \r
2361                 if ( $notifyComment == 0 )\r
2362                 {\r
2363                         $notifyComment = 1;\r
2364                 }\r
2365                 if ( $notifyVote == 0 )\r
2366                 {\r
2367                         $notifyVote = 1;\r
2368                 }\r
2369                 if ( $notifyNewItem == 0 )\r
2370                 {\r
2371                         $notifyNewItem = 1;\r
2372                 }\r
2373                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2374                 \r
2375                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2376                 {\r
2377                         self::error(_ERROR_BADNOTIFY);\r
2378                 }\r
2379                 \r
2380                 if ( !isValidShortName($shortname) )\r
2381                 {\r
2382                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2383                 }\r
2384                 \r
2385                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2386                 {\r
2387                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2388                 }\r
2389                 // check if update file is writable\r
2390                 if ( $updatefile && !is_writeable($updatefile) )\r
2391                 {\r
2392                         self::error(_ERROR_UPDATEFILE);\r
2393                 }\r
2394                 \r
2395                 $blog->setName(trim(postVar('name')));\r
2396                 $blog->setShortName($shortname);\r
2397                 $blog->setNotifyAddress($notify_address);\r
2398                 $blog->setNotifyType($notifyType);\r
2399                 $blog->setMaxComments(postVar('maxcomments'));\r
2400                 $blog->setCommentsEnabled(postVar('comments'));\r
2401                 $blog->setTimeOffset(postVar('timeoffset'));\r
2402                 $blog->setUpdateFile($updatefile);\r
2403                 $blog->setURL(trim(postVar('url')));\r
2404                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2405                 $blog->setDescription(trim(postVar('desc')));\r
2406                 $blog->setPublic(postVar('public'));\r
2407                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2408                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2409                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2410                 $blog->setSearchable(intPostVar('searchable'));\r
2411                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2412                 $blog->writeSettings();\r
2413                 \r
2414                 // store plugin options\r
2415                 $aOptions = requestArray('plugoption');\r
2416                 NucleusPlugin::apply_plugin_options($aOptions);\r
2417                 \r
2418                 $data = array(\r
2419                         'context' => 'blog',\r
2420                         'blogid'  => $blogid,\r
2421                         'blog'    => &$blog\r
2422                 );\r
2423                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2424                 \r
2425                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2426                 return;\r
2427         }\r
2428         \r
2429         /**\r
2430          * Admin::action_deleteblog()\r
2431          * \r
2432          * @param       void\r
2433          * @return      void\r
2434          */\r
2435         static private function action_deleteblog()\r
2436         {\r
2437                 global $member, $CONF, $manager;\r
2438                 \r
2439                 $blogid = intRequestVar('blogid');\r
2440                 \r
2441                 $member->blogAdminRights($blogid) or self::disallow();\r
2442                 \r
2443                 // check if blog is default blog\r
2444                 if ( $CONF['DefaultBlog'] == $blogid )\r
2445                 {\r
2446                         self::error(_ERROR_DELDEFBLOG);\r
2447                 }\r
2448                 \r
2449                 $blog =& $manager->getBlog($blogid);\r
2450                 \r
2451                 self::$skin->parse('deleteblog');\r
2452                 return;\r
2453         }\r
2454         \r
2455         /**\r
2456          * Admin::action_deleteblogconfirm()\r
2457          * Delete Blog\r
2458          * \r
2459          * @param       Void\r
2460          * @return      Void\r
2461          */\r
2462         static private function action_deleteblogconfirm()\r
2463         {\r
2464                 global $member, $CONF, $manager;\r
2465                 \r
2466                 $blogid = intRequestVar('blogid');\r
2467                 \r
2468                 $data = array('blogid' => $blogid);\r
2469                 $manager->notify('PreDeleteBlog', $data);\r
2470                 \r
2471                 $member->blogAdminRights($blogid) or self::disallow();\r
2472                 \r
2473                 // check if blog is default blog\r
2474                 if ( $CONF['DefaultBlog'] == $blogid )\r
2475                 {\r
2476                         self::error(_ERROR_DELDEFBLOG);\r
2477                 }\r
2478                 \r
2479                 // delete all comments\r
2480                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2481                 DB::execute($query);\r
2482                 \r
2483                 // delete all items\r
2484                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2485                 DB::execute($query);\r
2486                 \r
2487                 // delete all team members\r
2488                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2489                 DB::execute($query);\r
2490                 \r
2491                 // delete all bans\r
2492                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2493                 DB::execute($query);\r
2494                 \r
2495                 // delete all categories\r
2496                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2497                 DB::execute($query);\r
2498                 \r
2499                 // delete all associated plugin options\r
2500                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2501                 \r
2502                 // delete the blog itself\r
2503                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2504                 DB::execute($query);\r
2505                 \r
2506                 $data = array('blogid' => $blogid);\r
2507                 $manager->notify('PostDeleteBlog', $data);\r
2508                 \r
2509                 self::action_overview(_DELETED_BLOG);\r
2510                 return;\r
2511         }\r
2512         \r
2513         /**\r
2514          * Admin::action_memberdelete()\r
2515          * \r
2516          * @param       void\r
2517          * @return      void\r
2518          */\r
2519         static private function action_memberdelete()\r
2520         {\r
2521                 global $member, $manager;\r
2522                 \r
2523                 $memberid = intRequestVar('memberid');\r
2524                 \r
2525                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2526                 \r
2527                 $mem = Member::createFromID($memberid);\r
2528                 \r
2529                 self::$skin->parse('memberdelete');\r
2530                 return;\r
2531         }\r
2532         \r
2533         /**\r
2534          * Admin::action_memberdeleteconfirm()\r
2535          * \r
2536          * @param       void\r
2537          * @return      void\r
2538          */\r
2539         static private function action_memberdeleteconfirm()\r
2540         {\r
2541                 global $member;\r
2542                 \r
2543                 $memberid = intRequestVar('memberid');\r
2544                 \r
2545                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2546                 \r
2547                 $error = self::deleteOneMember($memberid);\r
2548                 if ( $error )\r
2549                 {\r
2550                         self::error($error);\r
2551                 }\r
2552                 \r
2553                 if ( $member->isAdmin() )\r
2554                 {\r
2555                         self::action_usermanagement();\r
2556                 }\r
2557                 else\r
2558                 {\r
2559                         self::action_overview(_DELETED_MEMBER);\r
2560                 }\r
2561                 return;\r
2562         }\r
2563         \r
2564         /**\r
2565          * Admin::deleteOneMember()\r
2566          * Delete a member by id\r
2567          * \r
2568          * @static\r
2569          * @params      Integer $memberid       member id\r
2570          * @return      String  null string or error messages\r
2571          */\r
2572         static public function deleteOneMember($memberid)\r
2573         {\r
2574                 global $manager;\r
2575                 \r
2576                 $memberid = intval($memberid);\r
2577                 $mem = Member::createFromID($memberid);\r
2578                 \r
2579                 if ( !$mem->canBeDeleted() )\r
2580                 {\r
2581                         return _ERROR_DELETEMEMBER;\r
2582                 }\r
2583                 \r
2584                 $data = array('member' => &$mem);\r
2585                 $manager->notify('PreDeleteMember', $data);\r
2586                 \r
2587                 /* unlink comments from memberid */\r
2588                 if ( $memberid )\r
2589                 {\r
2590                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2591                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2592                         DB::execute($query);\r
2593                 }\r
2594                 \r
2595                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2596                 DB::execute($query);\r
2597                 \r
2598                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2599                 DB::execute($query);\r
2600                 \r
2601                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2602                 DB::execute($query);\r
2603                 \r
2604                 // delete all associated plugin options\r
2605                 NucleusPlugin::delete_option_values('member', $memberid);\r
2606                 \r
2607                 $data = array('member' => &$mem);\r
2608                 $manager->notify('PostDeleteMember', $data);\r
2609                 \r
2610                 return '';\r
2611         }\r
2612         \r
2613         /**\r
2614          * Admin::action_createnewlog()\r
2615          * \r
2616          * @param       void\r
2617          * @return      void\r
2618          */\r
2619         static private function action_createnewlog()\r
2620         {\r
2621                 global $member, $CONF, $manager;\r
2622                 \r
2623                 // Only Super-Admins can do this\r
2624                 $member->isAdmin() or self::disallow();\r
2625                 \r
2626                 self::$skin->parse('createnewlog');\r
2627                 return;\r
2628         }\r
2629         \r
2630         /**\r
2631          * Admin::action_addnewlog()\r
2632          * \r
2633          * @param       void\r
2634          * @return      void\r
2635          */\r
2636         static private function action_addnewlog()\r
2637         {\r
2638                 global $member, $manager, $CONF;\r
2639                 \r
2640                 // Only Super-Admins can do this\r
2641                 $member->isAdmin() or self::disallow();\r
2642                 \r
2643                 $bname                  = trim(postVar('name'));\r
2644                 $bshortname             = trim(postVar('shortname'));\r
2645                 $btimeoffset    = postVar('timeoffset');\r
2646                 $bdesc                  = trim(postVar('desc'));\r
2647                 $bdefskin               = postVar('defskin');\r
2648                 \r
2649                 if ( !isValidShortName($bshortname) )\r
2650                 {\r
2651                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2652                 }\r
2653                 \r
2654                 if ( $manager->existsBlog($bshortname) )\r
2655                 {\r
2656                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2657                 }\r
2658                 \r
2659                 $data = array(\r
2660                         'name'        => &$bname,\r
2661                         'shortname'   => &$bshortname,\r
2662                         'timeoffset'  => &$btimeoffset,\r
2663                         'description' => &$bdesc,\r
2664                         'defaultskin' => &$bdefskin\r
2665                 );\r
2666                 $manager->notify('PreAddBlog', $data);\r
2667                 \r
2668                 // add slashes for sql queries\r
2669                 $bname                  = DB::quoteValue($bname);\r
2670                 $bshortname             = DB::quoteValue($bshortname);\r
2671                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2672                 $bdesc                  = DB::quoteValue($bdesc);\r
2673                 $bdefskin               = DB::quoteValue($bdefskin);\r
2674                 \r
2675                 // create blog\r
2676                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2677                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2678                 DB::execute($query);\r
2679                 \r
2680                 $blogid = DB::getInsertId();\r
2681                 $blog   =& $manager->getBlog($blogid);\r
2682                 \r
2683                 // create new category\r
2684                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2685                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2686                 \r
2687                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2688                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2689                 $catid = DB::getInsertId();\r
2690                 \r
2691                 // set as default category\r
2692                 $blog->setDefaultCategory($catid);\r
2693                 $blog->writeSettings();\r
2694                 \r
2695                 // create team member\r
2696                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2697                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2698                 DB::execute($query);\r
2699                 \r
2700                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2701                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2702                 \r
2703                 $blog->additem(\r
2704                         $blog->getDefaultCategory(),\r
2705                         $itemdeftitle,$itemdefbody,\r
2706                         '',\r
2707                         $blogid,\r
2708                         $member->getID(),\r
2709                         $blog->getCorrectTime(),\r
2710                         0,\r
2711                         0,\r
2712                         0\r
2713                 );\r
2714                 \r
2715                 $data = array('blog' => &$blog);\r
2716                 $manager->notify('PostAddBlog', $data);\r
2717                 \r
2718                 $data = array(\r
2719                         'blog'                  => &$blog,\r
2720                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2721                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2722                         'catid'                 => $catid\r
2723                 );\r
2724                 $manager->notify('PostAddCategory', $data);\r
2725                 \r
2726                 /* TODO: we should consider to use the other way insterad of this */\r
2727                 $_REQUEST['blogid'] = $blogid;\r
2728                 $_REQUEST['catid']  = $catid;\r
2729                 self::$skin->parse('addnewlog');\r
2730                 return;\r
2731         }\r
2732         \r
2733         /**\r
2734          * Admin::action_addnewlog2()\r
2735          * \r
2736          * @param       void\r
2737          * @return      void\r
2738          */\r
2739         static private function action_addnewlog2()\r
2740         {\r
2741                 global $member, $manager;\r
2742                 $blogid = intRequestVar('blogid');\r
2743                 \r
2744                 $member->blogAdminRights($blogid) or self::disallow();\r
2745                 \r
2746                 $burl = requestVar('url');\r
2747                 \r
2748                 $blog =& $manager->getBlog($blogid);\r
2749                 $blog->setURL(trim($burl));\r
2750                 $blog->writeSettings();\r
2751                 \r
2752                 self::action_overview(_MSG_NEWBLOG);\r
2753                 return;\r
2754         }\r
2755         \r
2756         /**\r
2757          * Admin::action_skinieoverview()\r
2758          * \r
2759          * @param       void\r
2760          * @return      void\r
2761          */\r
2762         static private function action_skinieoverview()\r
2763         {\r
2764                 global $member, $DIR_LIBS, $manager;\r
2765                 \r
2766                 $member->isAdmin() or self::disallow();\r
2767                 \r
2768                 include_once($DIR_LIBS . 'skinie.php');\r
2769                 \r
2770                 self::$skin->parse('skinieoverview');\r
2771                 return;\r
2772         }\r
2773         \r
2774         /**\r
2775          * Admin::action_skinieimport()\r
2776          * \r
2777          * @param       void\r
2778          * @return      void\r
2779          */\r
2780         static private function action_skinieimport()\r
2781         {\r
2782                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2783                 \r
2784                 $member->isAdmin() or self::disallow();\r
2785                 \r
2786                 // load skinie class\r
2787                 include_once($DIR_LIBS . 'skinie.php');\r
2788                 \r
2789                 $skinFileRaw    = postVar('skinfile');\r
2790                 $mode                   = postVar('mode');\r
2791                 \r
2792                 $importer = new SkinImport();\r
2793                 \r
2794                 // get full filename\r
2795                 if ( $mode == 'file' )\r
2796                 {\r
2797                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2798                         \r
2799                         /* TODO: remove this\r
2800                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2801                         if ( !file_exists($skinFile) )\r
2802                         {\r
2803                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2804                         }\r
2805                          */\r
2806                 }\r
2807                 else\r
2808                 {\r
2809                         $skinFile = $skinFileRaw;\r
2810                 }\r
2811                 \r
2812                 // read only metadata\r
2813                 $error = $importer->readFile($skinFile, 1);\r
2814                 \r
2815                 /* TODO: we should consider to use the other way insterad of this */\r
2816                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2817                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2818                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2819                 \r
2820                 // clashes\r
2821                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2822                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2823                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2824                 \r
2825                 /* TODO: we should consider to use the other way insterad of this */\r
2826                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2827                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2828                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2829                 \r
2830                 if ( $error )\r
2831                 {\r
2832                         self::error($error);\r
2833                 }\r
2834                 \r
2835                 self::$skin->parse('skinieimport');\r
2836                 return;\r
2837         }\r
2838         \r
2839         /**\r
2840          * Admin::action_skiniedoimport()\r
2841          * \r
2842          * @param       void\r
2843          * @return      void\r
2844          */\r
2845         static private function action_skiniedoimport()\r
2846         {\r
2847                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2848                 \r
2849                 $member->isAdmin() or self::disallow();\r
2850                 \r
2851                 // load skinie class\r
2852                 include_once($DIR_LIBS . 'skinie.php');\r
2853                 \r
2854                 $skinFileRaw    = postVar('skinfile');\r
2855                 $mode                   = postVar('mode');\r
2856                 \r
2857                 $allowOverwrite = intPostVar('overwrite');\r
2858                 \r
2859                 // get full filename\r
2860                 if ( $mode == 'file' )\r
2861                 {\r
2862                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2863                         \r
2864                         /* TODO: remove this\r
2865                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2866                         if ( !file_exists($skinFile) )\r
2867                         {\r
2868                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2869                         }\r
2870                         */\r
2871                 }\r
2872                 else\r
2873                 {\r
2874                         $skinFile = $skinFileRaw;\r
2875                 }\r
2876                 \r
2877                 $importer = new SkinImport();\r
2878                 \r
2879                 $error = $importer->readFile($skinFile);\r
2880                 \r
2881                 if ( $error )\r
2882                 {\r
2883                         self::error($error);\r
2884                 }\r
2885                 \r
2886                 $error = $importer->writeToDatabase($allowOverwrite);\r
2887                 \r
2888                 if ( $error )\r
2889                 {\r
2890                         self::error($error);\r
2891                 }\r
2892                 \r
2893                 /* TODO: we should consider to use the other way insterad of this */\r
2894                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2895                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2896                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2897                 \r
2898                 self::$skin->parse('skiniedoimport');\r
2899                 return;\r
2900         }\r
2901 \r
2902         /**\r
2903          * Admin::action_skinieexport()\r
2904          * \r
2905          * @param       void\r
2906          * @return      void\r
2907          */\r
2908         static private function action_skinieexport()\r
2909         {\r
2910                 global $member, $DIR_LIBS;\r
2911                 \r
2912                 $member->isAdmin() or self::disallow();\r
2913                 \r
2914                 // load skinie class\r
2915                 include_once($DIR_LIBS . 'skinie.php');\r
2916                 \r
2917                 $aSkins         = requestIntArray('skin');\r
2918                 $aTemplates     = requestIntArray('template');\r
2919                 \r
2920                 if ( !is_array($aTemplates) )\r
2921                 {\r
2922                         $aTemplates = array();\r
2923                 }\r
2924                 if ( !is_array($aSkins) )\r
2925                 {\r
2926                         $aSkins = array();\r
2927                 }\r
2928                 \r
2929                 $skinList               = array_keys($aSkins);\r
2930                 $templateList   = array_keys($aTemplates);\r
2931                 \r
2932                 $info = postVar('info');\r
2933                 \r
2934                 $exporter = new SkinExport();\r
2935                 foreach ( $skinList as $skinId )\r
2936                 {\r
2937                         $exporter->addSkin($skinId);\r
2938                 }\r
2939                 foreach ($templateList as $templateId)\r
2940                 {\r
2941                         $exporter->addTemplate($templateId);\r
2942                 }\r
2943                 $exporter->setInfo($info);\r
2944                 \r
2945                 $exporter->export();\r
2946                 return;\r
2947         }\r
2948         \r
2949         /**\r
2950          * Admin::action_templateoverview()\r
2951          * \r
2952          * @param       void\r
2953          * @return      void\r
2954          */\r
2955         static private function action_templateoverview()\r
2956         {\r
2957                 global $member, $manager;\r
2958                 \r
2959                 $member->isAdmin() or self::disallow();\r
2960                 \r
2961                 self::$skin->parse('templateoverview');\r
2962                 return;\r
2963         }\r
2964         \r
2965         /**\r
2966          * Admin::action_templateedit()\r
2967          * \r
2968          * @param       string  $msg    message for pageheader\r
2969          * @return      void\r
2970          */\r
2971         static private function action_templateedit($msg = '')\r
2972         {\r
2973                 global $member, $manager;\r
2974                 if ( $msg )\r
2975                 {\r
2976                         self::$headMess = $msg;\r
2977                 }\r
2978                 \r
2979                 $templateid = intRequestVar('templateid');\r
2980                 \r
2981                 $member->isAdmin() or self::disallow();\r
2982                 \r
2983                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
2984                 Admin::$extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
2985                 \r
2986                 self::$skin->parse('templateedit');\r
2987                 return;\r
2988         }\r
2989         \r
2990         /**\r
2991          * TODO: remove this\r
2992          *\r
2993         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
2994                 static $count = 1;\r
2995                 if (!isset($template[$name])) $template[$name] = '';\r
2996         ?>\r
2997                 </tr><tr>\r
2998                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
2999                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3000         <?php       $count++;\r
3001         }\r
3002         */\r
3003         \r
3004         /**\r
3005          * Admin::action_templateupdate()\r
3006          * \r
3007          * @param       void\r
3008          * @return      void\r
3009          */\r
3010         static private function action_templateupdate()\r
3011         {\r
3012                 global $member,$manager;\r
3013                 \r
3014                 $templateid = intRequestVar('templateid');\r
3015                 \r
3016                 $member->isAdmin() or self::disallow();\r
3017                 \r
3018                 $name = postVar('tname');\r
3019                 $desc = postVar('tdesc');\r
3020                 \r
3021                 if ( !isValidTemplateName($name) )\r
3022                 {\r
3023                         self::error(_ERROR_BADTEMPLATENAME);\r
3024                 }\r
3025                 \r
3026                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3027                 {\r
3028                         self::error(_ERROR_DUPTEMPLATENAME);\r
3029                 }\r
3030                 \r
3031                 // 1. Remove all template parts\r
3032                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3033                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3034                 DB::execute($query);\r
3035                 \r
3036                 // 2. Update description\r
3037                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3038                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3039                 DB::execute($query);\r
3040                 \r
3041                 // 3. Add non-empty template parts\r
3042                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3043                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3044                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3045                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3046                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3047                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3048                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3049                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3050                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3051                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3052                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3053                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3054                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3055                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3056                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3057                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3058                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3059                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3060                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3061                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3062                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3063                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3064                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3065                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3066                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3067                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3068                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3069                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3070                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3071                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3072                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3073                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3074                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3075                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3076                 \r
3077                 $data = array('fields' => array());\r
3078                 $manager->notify('TemplateExtraFields', $data);\r
3079                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3080                 {\r
3081                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3082                         {\r
3083                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3084                         }\r
3085                 }\r
3086                 \r
3087                 // jump back to template edit\r
3088                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3089                 return;\r
3090         }\r
3091         \r
3092         /**\r
3093          * Admin::addToTemplate()\r
3094          * \r
3095          * @param       Integer $id     ID for template\r
3096          * @param       String  $partname       parts name\r
3097          * @param       String  $content        template contents\r
3098          * @return      Integer record index\r
3099          * \r
3100          */\r
3101         static private function addToTemplate($id, $partname, $content)\r
3102         {\r
3103                 // don't add empty parts:\r
3104                 if ( !trim($content) )\r
3105                 {\r
3106                         return -1;\r
3107                 }\r
3108                 \r
3109                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3110                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3111                 if ( DB::execute($query) === FALSE )\r
3112                 {\r
3113                         $err = DB::getError();\r
3114                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3115                 }\r
3116                 return DB::getInsertId();\r
3117         }\r
3118         \r
3119         /**\r
3120          * Admin::action_templatedelete()\r
3121          * \r
3122          * @param       void\r
3123          * @return      void\r
3124          */\r
3125         static private function action_templatedelete()\r
3126         {\r
3127                 global $member, $manager;\r
3128                 \r
3129                 $member->isAdmin() or self::disallow();\r
3130                 \r
3131                 $templateid = intRequestVar('templateid');\r
3132                 // TODO: check if template can be deleted\r
3133                 \r
3134                 self::$skin->parse('templatedelete');\r
3135                 return;\r
3136         }\r
3137         \r
3138         /**\r
3139          * Admin::action_templatedeleteconfirm()\r
3140          * \r
3141          * @param       void\r
3142          * @return      void\r
3143          */\r
3144         static private function action_templatedeleteconfirm()\r
3145         {\r
3146                 global $member, $manager;\r
3147                 \r
3148                 $templateid = intRequestVar('templateid');\r
3149                 \r
3150                 $member->isAdmin() or self::disallow();\r
3151                 \r
3152                 $data = array('templateid' => $templateid);\r
3153                 $manager->notify('PreDeleteTemplate', $data);\r
3154                 \r
3155                 // 1. delete description\r
3156                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3157                 \r
3158                 // 2. delete parts\r
3159                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3160                 \r
3161                 \r
3162                 $data = array('templateid' => $templateid);\r
3163                 $manager->notify('PostDeleteTemplate', $data);\r
3164                 \r
3165                 self::action_templateoverview();\r
3166                 return;\r
3167         }\r
3168         \r
3169         /**\r
3170          * Admin::action_templatenew()\r
3171          * \r
3172          * @param       void\r
3173          * @return      void\r
3174          */\r
3175         static private function action_templatenew()\r
3176         {\r
3177                 global $member;\r
3178                 \r
3179                 $member->isAdmin() or self::disallow();\r
3180                 \r
3181                 $name = postVar('name');\r
3182                 $desc = postVar('desc');\r
3183                 \r
3184                 if ( !isValidTemplateName($name) )\r
3185                 {\r
3186                         self::error(_ERROR_BADTEMPLATENAME);\r
3187                 }\r
3188                 \r
3189                 if ( Template::exists($name) )\r
3190                 {\r
3191                         self::error(_ERROR_DUPTEMPLATENAME);\r
3192                 }\r
3193                 \r
3194                 $newTemplateId = Template::createNew($name, $desc);\r
3195                 \r
3196                 self::action_templateoverview();\r
3197                 return;\r
3198         }\r
3199         \r
3200         /**\r
3201          * Admin::action_templateclone()\r
3202          * \r
3203          * @param       void\r
3204          * @return      void\r
3205          */\r
3206         static private function action_templateclone()\r
3207         {\r
3208                 global $member;\r
3209                 \r
3210                 $templateid = intRequestVar('templateid');\r
3211                 \r
3212                 $member->isAdmin() or self::disallow();\r
3213                 \r
3214                 // 1. read old template\r
3215                 $name = Template::getNameFromId($templateid);\r
3216                 $desc = Template::getDesc($templateid);\r
3217                 \r
3218                 // 2. create desc thing\r
3219                 $name = "cloned" . $name;\r
3220                 \r
3221                 // if a template with that name already exists:\r
3222                 if ( Template::exists($name) )\r
3223                 {\r
3224                         $i = 1;\r
3225                         while (Template::exists($name . $i))\r
3226                         {\r
3227                                 $i++;\r
3228                         }\r
3229                         $name .= $i;\r
3230                 }\r
3231                 \r
3232                 $newid = Template::createNew($name, $desc);\r
3233                 \r
3234                 // 3. create clone\r
3235                 // go through parts of old template and add them to the new one\r
3236                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3237                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3238                 \r
3239                 $res = DB::getResult($query);\r
3240                 foreach ( $res as $row)\r
3241                 {\r
3242                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3243                 }\r
3244                 \r
3245                 self::action_templateoverview();\r
3246                 return;\r
3247         }\r
3248         \r
3249         /**\r
3250          * Admin::action_admintemplateoverview()\r
3251          * \r
3252          * @param       void\r
3253          * @return      void\r
3254          */\r
3255         static private function action_admintemplateoverview()\r
3256         {\r
3257                 global $member;\r
3258                 $member->isAdmin() or self::disallow();\r
3259                 self::$skin->parse('admntemplateoverview');\r
3260                 return;\r
3261         }\r
3262         \r
3263         /**\r
3264          * Admin::action_admintemplateedit()\r
3265          * \r
3266          * @param       string  $msg    message for pageheader\r
3267          * @return      void\r
3268          */\r
3269         static private function action_admintemplateedit($msg = '')\r
3270         {\r
3271                 global $member, $manager;\r
3272                 if ( $msg )\r
3273                 {\r
3274                         self::$headMess = $msg;\r
3275                 }\r
3276                 $member->isAdmin() or self::disallow();\r
3277                 \r
3278                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3279                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3280                 \r
3281                 self::$skin->parse('admintemplateedit');\r
3282                 return;\r
3283         }\r
3284         \r
3285         /**\r
3286          * Admin::action_admintemplateupdate()\r
3287          * \r
3288          * @param       void\r
3289          * @return      void\r
3290          */\r
3291         static private function action_admintemplateupdate()\r
3292         {\r
3293                 global $member, $manager;\r
3294                 $templateid = intRequestVar('templateid');\r
3295                 $member->isAdmin() or self::disallow();\r
3296                 $name = postVar('tname');\r
3297                 $desc = postVar('tdesc');\r
3298                 \r
3299                 if ( !isValidTemplateName($name) )\r
3300                 {\r
3301                         self::error(_ERROR_BADTEMPLATENAME);\r
3302                 }\r
3303                 \r
3304                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3305                 {\r
3306                         self::error(_ERROR_DUPTEMPLATENAME);\r
3307                 }\r
3308                 \r
3309                 // 1. Remove all template parts\r
3310                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3311                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3312                 DB::execute($query);\r
3313                 \r
3314                 // 2. Update description\r
3315                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3316                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3317                 DB::execute($query);\r
3318                 \r
3319                 // 3. Add non-empty template parts\r
3320                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3321                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3322                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3323                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3324                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3325                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3326                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3327                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3328                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3329                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3330                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3331                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3332                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3333                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3334                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3335                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3336                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3337                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3338                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3339                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3340                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3341                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3342                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3343                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3344                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3345                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3346                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3347                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3348                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3349                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3350                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3351                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3352                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3353                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3354                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3355                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3356                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3357                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3358                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3359                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3360                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3361                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3362                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3363                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3364                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3365                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3366                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3367                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3368                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3369                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3370                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3371                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3372                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3373                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3374                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3375                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3376                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3377                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3378                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3379                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3380                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3381                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3382                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3383                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3384                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3385                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3386                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3387                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3388                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3389                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3390                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3391                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3392                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3393                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3394                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3395                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3396                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3397                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3398                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3399                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3400                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3401                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3402                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3403                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3404                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3405                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3421                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3422                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3423                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3424                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3425                 \r
3426                 $data = array('fields' => array());\r
3427                 $manager->notify('TemplateExtraFields', $data);\r
3428                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3429                 {\r
3430                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3431                         {\r
3432                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3433                         }\r
3434                 }\r
3435                 \r
3436                 // jump back to template edit\r
3437                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3438                 return;\r
3439         }\r
3440         \r
3441         /**\r
3442          * Admin::addToAdminTemplate()\r
3443          * \r
3444          * @param       integer $id                     ID for template\r
3445          * @param       string  $partname       name of part for template\r
3446          * @param       void    $contents       content for part of template\r
3447          * @return      integer ID for newly inserted Template\r
3448          */\r
3449         static private function addToAdminTemplate($id, $partname, $content)\r
3450         {\r
3451                 // don't add empty parts:\r
3452                 if ( !trim($content) )\r
3453                 {\r
3454                         return -1;\r
3455                 }\r
3456                 \r
3457                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3458                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3459                 if ( DB::execute($query) === FALSE )\r
3460                 {\r
3461                         $err = DB::getError();\r
3462                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3463                 }\r
3464                 return DB::getInsertId();\r
3465         }\r
3466         \r
3467         /**\r
3468          * Admin::action_admintemplatedelete()\r
3469          * \r
3470          * @param       void\r
3471          * @return      void\r
3472          */\r
3473         static private function action_admintemplatedelete()\r
3474         {\r
3475                 global $member, $manager;\r
3476                 $member->isAdmin() or self::disallow();\r
3477                 \r
3478                 // TODO: check if template can be deleted\r
3479                 self::$skin->parse('admintemplatedelete');\r
3480                 return;\r
3481         }\r
3482         \r
3483         /**\r
3484          * Admin::action_admintemplatedeleteconfirm()\r
3485          * \r
3486          * @param       void\r
3487          * @return      void\r
3488          */\r
3489         static private function action_admintemplatedeleteconfirm()\r
3490         {\r
3491                 global $member, $manager;\r
3492                 \r
3493                 $templateid = intRequestVar('templateid');\r
3494                 $member->isAdmin() or self::disallow();\r
3495                 \r
3496                 $data = array('templateid' => $templateid);\r
3497                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3498                 \r
3499                 // 1. delete description\r
3500                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3501                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3502                 DB::execute($query);\r
3503                 \r
3504                 // 2. delete parts\r
3505                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3506                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3507                 DB::execute($query);\r
3508                 \r
3509                 $data = array('templateid' => $templateid);\r
3510                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3511                 \r
3512                 self::action_admintemplateoverview();\r
3513                 return;\r
3514         }\r
3515         \r
3516         /**\r
3517          * Admin::action_admintemplatenew()\r
3518          * \r
3519          * @param       void\r
3520          * @return      void\r
3521          */\r
3522         static private function action_admintemplatenew()\r
3523         {\r
3524                 global $member;\r
3525                 $member->isAdmin() or self::disallow();\r
3526                 $name = postVar('name');\r
3527                 $desc = postVar('desc');\r
3528                 \r
3529                 if ( !isValidTemplateName($name) )\r
3530                 {\r
3531                         self::error(_ERROR_BADTEMPLATENAME);\r
3532                 }\r
3533                 else if ( !preg_match('#^admin/#', $name) )\r
3534                 {\r
3535                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3536                 }\r
3537                 else if ( Template::exists($name) )\r
3538                 {\r
3539                         self::error(_ERROR_DUPTEMPLATENAME);\r
3540                 }\r
3541                 \r
3542                 $newTemplateId = Template::createNew($name, $desc);\r
3543                 self::action_admintemplateoverview();\r
3544                 return;\r
3545         }\r
3546         \r
3547         /**\r
3548          * Admin::action_admintemplateclone()\r
3549          * \r
3550          * @param       void\r
3551          * @return      void\r
3552          */\r
3553         static private function action_admintemplateclone()\r
3554         {\r
3555                 global $member;\r
3556                 $templateid = intRequestVar('templateid');\r
3557                 $member->isAdmin() or self::disallow();\r
3558                 \r
3559                 // 1. read old template\r
3560                 $name = Template::getNameFromId($templateid);\r
3561                 $desc = Template::getDesc($templateid);\r
3562                 \r
3563                 // 2. create desc thing\r
3564                 $name = $name . "cloned";\r
3565                 \r
3566                 // if a template with that name already exists:\r
3567                 if ( Template::exists($name) )\r
3568                 {\r
3569                         $i = 1;\r
3570                         while ( Template::exists($name . $i) )\r
3571                         {\r
3572                                 $i++;\r
3573                         }\r
3574                         $name .= $i;\r
3575                 }\r
3576                 \r
3577                 $newid = Template::createNew($name, $desc);\r
3578                 \r
3579                 // 3. create clone\r
3580                 // go through parts of old template and add them to the new one\r
3581                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3582                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3583                 \r
3584                 $res = DB::getResult($query);\r
3585                 foreach ( $res as $row )\r
3586                 {\r
3587                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3588                 }\r
3589                 \r
3590                 self::action_admintemplateoverview();\r
3591                 return;\r
3592         }\r
3593 \r
3594         /**\r
3595          * Admin::action_skinoverview()\r
3596          * \r
3597          * @param       void\r
3598          * @return      void\r
3599          */\r
3600         static private function action_skinoverview()\r
3601         {\r
3602                 global $member, $manager;\r
3603                 \r
3604                 $member->isAdmin() or self::disallow();\r
3605                 \r
3606                 self::$skin->parse('skinoverview');\r
3607                 return;\r
3608         }\r
3609         \r
3610         /**\r
3611          * Admin::action_skinnew()\r
3612          * \r
3613          * @param       void\r
3614          * @return      void\r
3615          */\r
3616         static private function action_skinnew()\r
3617         {\r
3618                 global $member;\r
3619                 \r
3620                 $member->isAdmin() or self::disallow();\r
3621                 \r
3622                 $name = trim(postVar('name'));\r
3623                 $desc = trim(postVar('desc'));\r
3624                 \r
3625                 if ( !isValidSkinName($name) )\r
3626                 {\r
3627                         self::error(_ERROR_BADSKINNAME);\r
3628                 }\r
3629                 \r
3630                 if ( SKIN::exists($name) )\r
3631                 {\r
3632                         self::error(_ERROR_DUPSKINNAME);\r
3633                 }\r
3634                 \r
3635                 $newId = SKIN::createNew($name, $desc);\r
3636                 \r
3637                 self::action_skinoverview();\r
3638                 return;\r
3639         }\r
3640         \r
3641         /**\r
3642          * Admin::action_skinedit()\r
3643          * \r
3644          * @param       void\r
3645          * @return      void\r
3646          */\r
3647         static private function action_skinedit()\r
3648         {\r
3649                 global $member, $manager;\r
3650                 \r
3651                 $member->isAdmin() or self::disallow();\r
3652                 \r
3653                 self::$skin->parse('skinedit');\r
3654                 return;\r
3655         }\r
3656         \r
3657         /**\r
3658          * Admin::action_skineditgeneral()\r
3659          * \r
3660          * @param       void\r
3661          * @return      void\r
3662          */\r
3663         static private function action_skineditgeneral()\r
3664         {\r
3665                 global $member;\r
3666                 \r
3667                 $skinid = intRequestVar('skinid');\r
3668                 \r
3669                 $member->isAdmin() or self::disallow();\r
3670                 \r
3671                 $name           = postVar('name');\r
3672                 $desc           = postVar('desc');\r
3673                 $type           = postVar('type');\r
3674                 $inc_mode       = postVar('inc_mode');\r
3675                 $inc_prefix     = postVar('inc_prefix');\r
3676                 \r
3677                 $skin = new Skin($skinid);\r
3678                 \r
3679                 // 1. Some checks\r
3680                 if ( !isValidSkinName($name) )\r
3681                 {\r
3682                         self::error(_ERROR_BADSKINNAME);\r
3683                 }\r
3684                 \r
3685                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3686                 {\r
3687                         self::error(_ERROR_DUPSKINNAME);\r
3688                 }\r
3689                 \r
3690                 if ( !$type )\r
3691                 {\r
3692                         $type = 'text/html';\r
3693                 }\r
3694                 if ( !$inc_mode )\r
3695                 {\r
3696                         $inc_mode = 'normal';\r
3697                 }\r
3698                 \r
3699                 // 2. Update description\r
3700                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3701                 \r
3702                 self::action_skinedit();\r
3703                 return;\r
3704         }\r
3705         \r
3706         static private function action_skinedittype($msg = '')\r
3707         {\r
3708                 global $member, $manager;\r
3709                 \r
3710                 $member->isAdmin() or self::disallow();\r
3711                 \r
3712                 if ( $msg )\r
3713                 {\r
3714                         self::$headMess = $msg;\r
3715                 }\r
3716                 \r
3717                 $skinid = intRequestVar('skinid');\r
3718                 $type   = requestVar('type');\r
3719                 $type   = trim($type);\r
3720                 $type   = strtolower($type);\r
3721                 \r
3722                 if ( !isValidShortName($type) )\r
3723                 {\r
3724                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3725                 }\r
3726                 \r
3727                 self::$skin->parse('skinedittype');\r
3728                 return;\r
3729         }\r
3730         \r
3731         /**\r
3732          * Admin::action_skinupdate()\r
3733          * \r
3734          * @param       void\r
3735          * @return      void\r
3736          */\r
3737         static private function action_skinupdate()\r
3738         {\r
3739                 global $member;\r
3740                 \r
3741                 $skinid = intRequestVar('skinid');\r
3742                 $content = trim(postVar('content'));\r
3743                 $type = postVar('type');\r
3744                 \r
3745                 $member->isAdmin() or self::disallow();\r
3746                 \r
3747                 $skin = new SKIN($skinid);\r
3748                 $skin->update($type, $content);\r
3749                 \r
3750                 self::action_skinedittype(_SKIN_UPDATED);\r
3751                 return;\r
3752         }\r
3753         \r
3754         /**\r
3755          * Admin::action_skindelete()\r
3756          * \r
3757          * @param       void\r
3758          * @return      void\r
3759          */\r
3760         static private function action_skindelete()\r
3761         {\r
3762                 global $member, $manager, $CONF;\r
3763                 \r
3764                 $skinid = intRequestVar('skinid');\r
3765                 \r
3766                 $member->isAdmin() or self::disallow();\r
3767                 \r
3768                 // don't allow default skin to be deleted\r
3769                 if ( $skinid == $CONF['BaseSkin'] )\r
3770                 {\r
3771                         self::error(_ERROR_DEFAULTSKIN);\r
3772                 }\r
3773                 \r
3774                 // don't allow deletion of default skins for blogs\r
3775                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3776                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3777                 \r
3778                 $name = DB::getValue($query);\r
3779                 if ( $name )\r
3780                 {\r
3781                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3782                 }\r
3783                 \r
3784                 self::$skin->parse('skindelete');\r
3785                 return;\r
3786         }\r
3787         \r
3788         /**\r
3789          * Admin::action_skindeleteconfirm()\r
3790          * \r
3791          * @param       void\r
3792          * @return      void\r
3793          */\r
3794         static private function action_skindeleteconfirm()\r
3795         {\r
3796                 global $member, $CONF, $manager;\r
3797                 \r
3798                 $skinid = intRequestVar('skinid');\r
3799                 \r
3800                 $member->isAdmin() or self::disallow();\r
3801                 \r
3802                 // don't allow default skin to be deleted\r
3803                 if ( $skinid == $CONF['BaseSkin'] )\r
3804                 {\r
3805                         self::error(_ERROR_DEFAULTSKIN);\r
3806                 }\r
3807                 \r
3808                 // don't allow deletion of default skins for blogs\r
3809                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3810                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3811                 \r
3812                 $name = DB::getValue($query);\r
3813                 if ( $name )\r
3814                                 {\r
3815                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3816                 }\r
3817                 \r
3818                 $data = array('skinid' => $skinid);\r
3819                 $manager->notify('PreDeleteSkin', $data);\r
3820                 \r
3821                 // 1. delete description\r
3822                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3823                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3824                 DB::execute($query);\r
3825                 \r
3826                 // 2. delete parts\r
3827                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3828                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3829                 DB::execute($query);\r
3830                 \r
3831                 $data = array('skinid' => $skinid);\r
3832                 $manager->notify('PostDeleteSkin', $data);\r
3833                 \r
3834                 self::action_skinoverview();\r
3835                 return;\r
3836         }\r
3837         \r
3838         /**\r
3839          * Admin::action_skinremovetype()\r
3840          * \r
3841          * @param       void\r
3842          * @return      void\r
3843          */\r
3844         static private function action_skinremovetype()\r
3845         {\r
3846                 global $member, $manager, $CONF;\r
3847                 \r
3848                 $member->isAdmin() or self::disallow();\r
3849                 \r
3850                 $skinid = intRequestVar('skinid');\r
3851                 $skintype = requestVar('type');\r
3852                 \r
3853                 if ( !isValidShortName($skintype) )\r
3854                 {\r
3855                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3856                 }\r
3857                 \r
3858                 // don't allow default skinparts to be deleted\r
3859                 /* TODO: this array should be retrieved from Action class */\r
3860                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3861                 {\r
3862                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3863                 }\r
3864                 \r
3865                 self::$skin->parse('skinremovetype');\r
3866                 return;\r
3867         }\r
3868         \r
3869         /**\r
3870          * Admin::action_skinremovetypeconfirm()\r
3871          * \r
3872          * @param       void\r
3873          * @return      void\r
3874          */\r
3875         static private function action_skinremovetypeconfirm()\r
3876         {\r
3877                 global $member, $CONF, $manager;\r
3878                 \r
3879                 $member->isAdmin() or self::disallow();\r
3880                 \r
3881                 $skinid = intRequestVar('skinid');\r
3882                 $skintype = requestVar('type');\r
3883                 \r
3884                 if ( !isValidShortName($skintype) )\r
3885                 {\r
3886                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3887                 }\r
3888                 \r
3889                 // don't allow default skinparts to be deleted\r
3890                 /* TODO: this array should be retrieved from Action class */\r
3891                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3892                 {\r
3893                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3894                 }\r
3895                 \r
3896                 $data = array(\r
3897                         'skinid'   => $skinid,\r
3898                         'skintype' => $skintype\r
3899                 );\r
3900                 $manager->notify('PreDeleteSkinPart', $data);\r
3901                 \r
3902                 // delete part\r
3903                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
3904                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
3905                 DB::execute($query);\r
3906                 \r
3907                 $data = array(\r
3908                         'skinid'   => $skinid,\r
3909                         'skintype' => $skintype\r
3910                 );\r
3911                 $manager->notify('PostDeleteSkinPart', $data);\r
3912                 \r
3913                 self::action_skinedit();\r
3914                 return;\r
3915         }\r
3916 \r
3917         /**\r
3918          * Admin::action_skinclone()\r
3919          * \r
3920          * @param       void\r
3921          * @return      void\r
3922          */\r
3923         static private function action_skinclone()\r
3924         {\r
3925                 global $member;\r
3926                 \r
3927                 $member->isAdmin() or self::disallow();\r
3928                 \r
3929                 $skinid = intRequestVar('skinid');\r
3930                 \r
3931                 // 1. read skin to clone\r
3932                 $skin = new Skin($skinid);\r
3933                 \r
3934                 $name = "{$skin->getName()}_clone";\r
3935                 \r
3936                 // if a skin with that name already exists:\r
3937                 if ( Skin::exists($name) )\r
3938                 {\r
3939                         $i = 1;\r
3940                         while ( Skin::exists($name . $i) )\r
3941                         {\r
3942                                 $i++;\r
3943                         }\r
3944                         $name .= $i;\r
3945                 }\r
3946                 \r
3947                 // 2. create skin desc\r
3948                 $newid = Skin::createNew(\r
3949                         $name,\r
3950                         $skin->getDescription(),\r
3951                         $skin->getContentType(),\r
3952                         $skin->getIncludeMode(),\r
3953                         $skin->getIncludePrefix()\r
3954                 );\r
3955                 \r
3956                 // 3. clone\r
3957                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
3958                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3959                 \r
3960                 $res = DB::getResult($query);\r
3961                 foreach ( $res as $row )\r
3962                 {\r
3963                         self::skinclonetype($skin, $newid, $row['stype']);\r
3964                 }\r
3965                 \r
3966                 self::action_skinoverview();\r
3967                 return;\r
3968         }\r
3969         \r
3970         /**\r
3971          * Admin::skinclonetype()\r
3972          * \r
3973          * @param       String  $skin   Skin object\r
3974          * @param       Integer $newid  ID for this clone\r
3975          * @param       String  $type   type of skin\r
3976          * @return      Void\r
3977          */\r
3978         static private function skinclonetype($skin, $newid, $type)\r
3979         {\r
3980                 $newid = intval($newid);\r
3981                 $content = $skin->getContentFromDB($type);\r
3982                 \r
3983                 if ( $content )\r
3984                 {\r
3985                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
3986                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
3987                         DB::execute($query);\r
3988                 }\r
3989                 return;\r
3990         }\r
3991         \r
3992         /**\r
3993          * Admin::action_adminskinoverview()\r
3994          * \r
3995          * @param       void\r
3996          * @return      void\r
3997          */\r
3998         static private function action_adminskinoverview()\r
3999         {\r
4000                 global $member, $manager;\r
4001                 \r
4002                 $member->isAdmin() or self::disallow();\r
4003                 \r
4004                 self::$skin->parse('adminskinoverview');\r
4005                 return;\r
4006         }\r
4007         \r
4008         /**\r
4009          * Admin::action_adminskinnew()\r
4010          * \r
4011          * @param       void\r
4012          * @return      void\r
4013          */\r
4014         static private function action_adminskinnew()\r
4015         {\r
4016                 global $member;\r
4017                 $member->isAdmin() or self::disallow();\r
4018                 $name = trim(postVar('name'));\r
4019                 $desc = trim(postVar('desc'));\r
4020                 \r
4021                 if ( !isValidSkinName($name) )\r
4022                 {\r
4023                         self::error(_ERROR_BADSKINNAME);\r
4024                 }\r
4025                 else if ( !preg_match('#^admin/#', $name) )\r
4026                 {\r
4027                         self::error(_ERROR_BADADMINSKINNAME);\r
4028                 }\r
4029                 else if ( Skin::exists($name) )\r
4030                 {\r
4031                         self::error(_ERROR_DUPSKINNAME);\r
4032                 }\r
4033                 /* TODO: $newId is not reused... */\r
4034                 $newId = Skin::createNew($name, $desc);\r
4035                 self::action_adminskinoverview();\r
4036                 return;\r
4037         }\r
4038         \r
4039         /**\r
4040          * Admin::action_adminskinedit()\r
4041          * \r
4042          * @param       void\r
4043          * @return      void\r
4044          */\r
4045         static private function action_adminskinedit()\r
4046         {\r
4047                 global $member, $manager;\r
4048                 \r
4049                 $member->isAdmin() or self::disallow();\r
4050                 self::$skin->parse('adminskinedit');\r
4051                 return;\r
4052         }\r
4053         \r
4054         /**\r
4055          * Admin::action_adminskineditgeneral()\r
4056          * \r
4057          * @param       void\r
4058          * @return      void\r
4059          */\r
4060         static private function action_adminskineditgeneral()\r
4061         {\r
4062                 global $member;\r
4063                 \r
4064                 $skinid = intRequestVar('skinid');\r
4065                 \r
4066                 $member->isAdmin() or self::disallow();\r
4067                 \r
4068                 $name           = postVar('name');\r
4069                 $desc           = postVar('desc');\r
4070                 $type           = postVar('type');\r
4071                 $inc_mode       = postVar('inc_mode');\r
4072                 $inc_prefix     = postVar('inc_prefix');\r
4073                 \r
4074                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4075                 \r
4076                 // 1. Some checks\r
4077                 if ( !isValidSkinName($name) )\r
4078                 {\r
4079                         self::error(_ERROR_BADSKINNAME);\r
4080                 }\r
4081                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4082                 {\r
4083                         self::error(_ERROR_DUPSKINNAME);\r
4084                 }\r
4085                 if ( !$type )\r
4086                 {\r
4087                         $type = 'text/html';\r
4088                 }\r
4089                 if ( !$inc_mode )\r
4090                 {\r
4091                         $inc_mode = 'normal';\r
4092                 }\r
4093                 // 2. Update description\r
4094                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4095                 self::action_adminskinedit();\r
4096                 return;\r
4097         }\r
4098         \r
4099         /**\r
4100          * Admin::action_adminskinedittype()\r
4101          * \r
4102          * @param       string  $msg    message for pageheader\r
4103          * @return      void\r
4104          */\r
4105         static private function action_adminskinedittype($msg = '')\r
4106         {\r
4107                 global $member, $manager;\r
4108                 \r
4109                 $member->isAdmin() or self::disallow();\r
4110                 \r
4111                 if ( $msg )\r
4112                 {\r
4113                         self::$headMess = $msg;\r
4114                 }\r
4115                 $type = requestVar('type');\r
4116                 $type = trim($type);\r
4117                 $type = strtolower($type);\r
4118                 \r
4119                 if ( !isValidShortName($type) )\r
4120                 {\r
4121                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4122                 }\r
4123                 \r
4124                 self::$skin->parse('adminskinedittype');\r
4125                 return;\r
4126         }\r
4127         \r
4128         /**\r
4129          * Admin::action_adminskinupdate()\r
4130          * \r
4131          * @param       void\r
4132          * @return      void\r
4133          */\r
4134         static private function action_adminskinupdate()\r
4135         {\r
4136                 global $member;\r
4137                 $skinid         = intRequestVar('skinid');\r
4138                 $content        = trim(postVar('content'));\r
4139                 $type           = postVar('type');\r
4140                 \r
4141                 $member->isAdmin() or self::disallow();\r
4142                 \r
4143                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4144                 $skin->update($type, $content);\r
4145                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4146                 return;\r
4147         }\r
4148         \r
4149         /**\r
4150          * Admin::action_adminskindelete()\r
4151          * \r
4152          * @param       void\r
4153          * @return      void\r
4154          */\r
4155         static private function action_adminskindelete()\r
4156         {\r
4157                 global $member, $manager, $CONF;\r
4158                 $member->isAdmin() or self::disallow();\r
4159                 \r
4160                 /* TODO: needless variable $skinid... */\r
4161                 $skinid = intRequestVar('skinid');\r
4162                 self::$skin->parse('adminskindelete');\r
4163                 return;\r
4164         }\r
4165 \r
4166         /**\r
4167          * Admin::action_adminskindeleteconfirm()\r
4168          * \r
4169          * @param       void\r
4170          * @return      void\r
4171          */\r
4172         static private function action_adminskindeleteconfirm()\r
4173         {\r
4174                 global $member, $CONF, $manager;\r
4175                 \r
4176                 $member->isAdmin() or self::disallow();\r
4177                 $skinid = intRequestVar('skinid');\r
4178                 \r
4179                 // don't allow default skin to be deleted\r
4180                 if ( $skinid == $CONF['AdminSkin'] )\r
4181                 {\r
4182                         self::error(_ERROR_DEFAULTSKIN);\r
4183                 }\r
4184                 \r
4185                 /*\r
4186                  * TODO: NOT Implemented\r
4187                  *  don't allow deletion of default skins for members\r
4188                 $memberDefaults =  $member->getAdminSkin();\r
4189                 foreach ( $memberDefaults as $memID => $adminskin )\r
4190                 {\r
4191                         if ( $skinid == $adminskin )\r
4192                         {\r
4193                                 $mem = MEMBER::createFromID($memID);\r
4194                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4195                         }\r
4196                 }\r
4197                 */\r
4198                 \r
4199                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4200                 \r
4201                 // 1. delete description\r
4202                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4203                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4204                 DB::execute($query);\r
4205                 \r
4206                 // 2. delete parts\r
4207                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4208                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4209                 \r
4210                 DB::execute($query);\r
4211                 \r
4212                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4213                 self::action_adminskinoverview();\r
4214                 return;\r
4215         }\r
4216         \r
4217         /**\r
4218          * Admin::action_adminskinremovetype()\r
4219          * \r
4220          * @param       void\r
4221          * @return      void\r
4222          */\r
4223         static private function action_adminskinremovetype()\r
4224         {\r
4225                 global $member, $manager, $CONF;\r
4226 \r
4227                 $member->isAdmin() or self::disallow();\r
4228                 \r
4229                 $skinid         = intRequestVar('skinid');\r
4230                 $skintype       = requestVar('type');\r
4231                 \r
4232                 if ( !isValidShortName($skintype) )\r
4233                 {\r
4234                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4235                 }\r
4236                 \r
4237                 self::$skin->parse('adminskinremovetype');\r
4238                 return;\r
4239         }\r
4240         \r
4241         /**\r
4242          * Admin::action_adminskinremovetypeconfirm()\r
4243          * \r
4244          * @param       void\r
4245          * @return      void\r
4246          */\r
4247         static private function action_adminskinremovetypeconfirm()\r
4248         {\r
4249                 global $member, $CONF, $manager;\r
4250                 \r
4251                 $member->isAdmin() or self::disallow();\r
4252                 \r
4253                 $skinid         = intRequestVar('skinid');\r
4254                 $skintype       = requestVar('type');\r
4255                 \r
4256                 if ( !isValidShortName($skintype) )\r
4257                 {\r
4258                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4259                 }\r
4260                 \r
4261                 $data =array(\r
4262                         'skinid'        => $skinid,\r
4263                         'skintype'      => $skintype\r
4264                 );\r
4265                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4266                 \r
4267                 // delete part\r
4268                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4269                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4270                 DB::execute($query);\r
4271                 \r
4272                 $data = array(\r
4273                         'skinid'        => $skinid,\r
4274                         'skintype'      => $skintype\r
4275                 );\r
4276                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4277                 \r
4278                 self::action_adminskinedit();\r
4279                 return;\r
4280         }\r
4281 \r
4282         /**\r
4283          * Admin::action_adminskinclone()\r
4284          * \r
4285          * @param       void\r
4286          * @return      void\r
4287          */\r
4288         static private function action_adminskinclone()\r
4289         {\r
4290                 global $member;\r
4291                 \r
4292                 $member->isAdmin() or self::disallow();\r
4293                 \r
4294                 $skinid = intRequestVar('skinid');\r
4295                 \r
4296                 // 1. read skin to clone\r
4297                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4298                 $name = "{$skin->getName()}_clone";\r
4299                 \r
4300                 // if a skin with that name already exists:\r
4301                 if ( Skin::exists($name) )\r
4302                 {\r
4303                         $i = 1;\r
4304                         while ( Skin::exists($name . $i) )\r
4305                         {\r
4306                                 $i++;\r
4307                         }\r
4308                         $name .= $i;\r
4309                 }\r
4310                 \r
4311                 // 2. create skin desc\r
4312                 $newid = Skin::createNew(\r
4313                         $name,\r
4314                         $skin->getDescription(),\r
4315                         $skin->getContentType(),\r
4316                         $skin->getIncludeMode(),\r
4317                         $skin->getIncludePrefix()\r
4318                 );\r
4319                 \r
4320                 // 3. clone\r
4321                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4322                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4323                 \r
4324                 $res = DB::getResult($query);\r
4325                 foreach ( $res as $row )\r
4326                 {\r
4327                         self::skinclonetype($skin, $newid, $row['stype']);\r
4328                 }\r
4329                 self::action_adminskinoverview();\r
4330                 return;\r
4331         }\r
4332         \r
4333         /**\r
4334          * Admin::adminskinclonetype()\r
4335          * \r
4336          * @param       string  $skin   an instance of Skin class\r
4337          * @param       integer $newid  ID for new skin\r
4338          * @param       string  $type   skin type\r
4339          * @return      void\r
4340          */\r
4341         static private function adminskinclonetype($skin, $newid, $type)\r
4342         {\r
4343                 $content = $skin->getContentFromDB($type);\r
4344                 \r
4345                 if ( $content )\r
4346                 {\r
4347                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4348                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4349                         DB::execute($query);\r
4350                 }\r
4351                 return;\r
4352         }\r
4353         \r
4354         /**\r
4355          * Admin::action_adminskinieoverview()\r
4356          * \r
4357          * @param       void\r
4358          * @return      void\r
4359          */\r
4360         static private function action_adminskinieoverview()\r
4361         {\r
4362                 global $member, $DIR_LIBS, $manager;\r
4363                 \r
4364                 $member->isAdmin() or self::disallow();\r
4365                 \r
4366                 // load skinie class\r
4367                 include_once($DIR_LIBS . 'skinie.php');\r
4368                 \r
4369                 self::$skin->parse('adminskinieoverview');\r
4370                 return;\r
4371         }\r
4372 \r
4373         /**\r
4374          * Admin::action_adminskinieimport()\r
4375          * \r
4376          * @param       void\r
4377          * @return      void\r
4378          */\r
4379         static private function action_adminskinieimport()\r
4380         {\r
4381                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4382                 \r
4383                 $member->isAdmin() or self::disallow();\r
4384                 \r
4385                 // load skinie class\r
4386                 include_once($DIR_LIBS . 'skinie.php');\r
4387                 \r
4388                 $skinFileRaw    = postVar('skinfile');\r
4389                 $mode                   = postVar('mode');\r
4390                 \r
4391                 $importer = new SKINIMPORT();\r
4392                 \r
4393                 // get full filename\r
4394                 if ( $mode == 'file' )\r
4395                 {\r
4396                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4397                         \r
4398                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4399                         if ( !file_exists($skinFile) )\r
4400                         {\r
4401                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4402                         }\r
4403                 }\r
4404                 else\r
4405                 {\r
4406                         $skinFile = $skinFileRaw;\r
4407                 }\r
4408                 \r
4409                 // read only metadata\r
4410                 $error = $importer->readFile($skinFile, 1);\r
4411                 if ( $error )\r
4412                 {\r
4413                         self::error($error);\r
4414                 }\r
4415                 \r
4416                 /* TODO: we should consider to use the other way instead of this */\r
4417                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4418                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4419                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4420                 \r
4421                 // clashes\r
4422                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4423                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4424                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4425                 /* TODO: we should consider to use the other way instead of this */\r
4426                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4427                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4428                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4429                 \r
4430                 self::$skin->parse('adminskinieimport');\r
4431                 return;\r
4432         }\r
4433         \r
4434         /**\r
4435          * Admin::action_adminskiniedoimport()\r
4436          * \r
4437          * @param       void\r
4438          * @return      void\r
4439          */\r
4440         static private function action_adminskiniedoimport()\r
4441         {\r
4442                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4443                 \r
4444                 $member->isAdmin() or self::disallow();\r
4445                 \r
4446                 // load skinie class\r
4447                 include_once($DIR_LIBS . 'skinie.php');\r
4448                 \r
4449                 $skinFileRaw    = postVar('skinfile');\r
4450                 $mode                   = postVar('mode');\r
4451                 $allowOverwrite = intPostVar('overwrite');\r
4452                 \r
4453                 // get full filename\r
4454                 if ( $mode == 'file' )\r
4455                 {\r
4456                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4457                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4458                         if ( !file_exists($skinFile) )\r
4459                         {\r
4460                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4461                         }\r
4462                 }\r
4463                 else\r
4464                 {\r
4465                         $skinFile = $skinFileRaw;\r
4466                 }\r
4467                 \r
4468                 $importer = new SKINIMPORT();\r
4469                 \r
4470                 $error = $importer->readFile($skinFile);\r
4471                 if ( $error )\r
4472                 {\r
4473                         self::error($error);\r
4474                 }\r
4475                 \r
4476                 $error = $importer->writeToDatabase($allowOverwrite);\r
4477                 if ( $error )\r
4478                 {\r
4479                         self::error($error);\r
4480                 }\r
4481                 \r
4482                 /* TODO: we should consider to use the other way instead of this */\r
4483                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4484                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4485                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4486                 \r
4487                 self::$skin->parse('adminskiniedoimport');\r
4488                 return;\r
4489         }\r
4490 \r
4491         /**\r
4492          * Admin::action_adminskinieexport()\r
4493          * \r
4494          * @param       void\r
4495          * @return      void\r
4496          */\r
4497         static private function action_adminskinieexport()\r
4498         {\r
4499                 global $member, $DIR_PLUGINS;\r
4500                 \r
4501                 $member->isAdmin() or self::disallow();\r
4502                 \r
4503                 // load skinie class\r
4504                 $aSkins = requestIntArray('skin');\r
4505                 if (!is_array($aSkins)) {\r
4506                         $aSkins = array();\r
4507                 }\r
4508                 $skinList = array_keys($aSkins);\r
4509                 \r
4510                 $aTemplates = requestIntArray('template');\r
4511                 if (!is_array($aTemplates))\r
4512                 {\r
4513                         $aTemplates = array();\r
4514                 }\r
4515                 $templateList = array_keys($aTemplates);\r
4516                 \r
4517                 $info = postVar('info');\r
4518                 \r
4519                 include_libs('skinie.php');\r
4520                 $exporter = new SkinExport();\r
4521                 foreach ( $skinList as $skinId )\r
4522                 {\r
4523                         $exporter->addSkin($skinId);\r
4524                 }\r
4525                 foreach ( $templateList as $templateId )\r
4526                 {\r
4527                         $exporter->addTemplate($templateId);\r
4528                 }\r
4529                 $exporter->setInfo($info);\r
4530                 $exporter->export();\r
4531                 return;\r
4532         }\r
4533         \r
4534         /**\r
4535          * Admin::action_settingsedit()\r
4536          * \r
4537          * @param       Void\r
4538          * @return      Void\r
4539          */\r
4540         static private function action_settingsedit()\r
4541         {\r
4542                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4543                 \r
4544                 $member->isAdmin() or self::disallow();\r
4545                 \r
4546                 self::$skin->parse('settingsedit');\r
4547                 return;\r
4548         }\r
4549         \r
4550         /**\r
4551          * Admin::action_settingsupdate()\r
4552          * Update $CONFIG and redirect\r
4553          * \r
4554          * @param       void\r
4555          * @return      void\r
4556          */\r
4557         static private function action_settingsupdate()\r
4558         {\r
4559                 global $member, $CONF;\r
4560                 \r
4561                 $member->isAdmin() or self::disallow();\r
4562                 \r
4563                 // check if email address for admin is valid\r
4564                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4565                 {\r
4566                         self::error(_ERROR_BADMAILADDRESS);\r
4567                 }\r
4568                 \r
4569                 // save settings\r
4570                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4571                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4572                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4573                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4574                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4575                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4576                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4577                 self::updateConfig('Locale',                    postVar('Locale'));\r
4578                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4579                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4580                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4581                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4582                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4583                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4584                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4585                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4586                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4587                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4588                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4589                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4590                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4591                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4592                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4593                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4594                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4595                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4596                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4597                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4598                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4599                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4600                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4601                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4602                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4603                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4604                 \r
4605                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4606                 // note that when changing cookie settings, this redirect might cause the user\r
4607                 // to have to log in again.\r
4608                 getConfig();\r
4609                 redirect($CONF['AdminURL'] . '?action=manage');\r
4610                 return;\r
4611         }\r
4612         \r
4613         /**\r
4614          * Admin::action_systemoverview()\r
4615          * Output system overview\r
4616          * \r
4617          * @param       void\r
4618          * @return      void\r
4619          */\r
4620         static private function action_systemoverview()\r
4621         {\r
4622                 self::$skin->parse('systemoverview');\r
4623                 return;\r
4624         }\r
4625         \r
4626         /**\r
4627          * Admin::updateConfig()\r
4628          * \r
4629          * @param       string  $name   \r
4630          * @param       string  $val    \r
4631          * @return      integer return the ID in which the latest query posted\r
4632          */\r
4633         static private function updateConfig($name, $val)\r
4634         {\r
4635                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4636                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4637                 if ( DB::execute($query) === FALSE )\r
4638                 {\r
4639                         $err = DB::getError();\r
4640                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4641                 }\r
4642                 return DB::getInsertId();\r
4643         }\r
4644         \r
4645         /**\r
4646          * Admin::error()\r
4647          * Error message\r
4648          * \r
4649          * @param       string  $msg    message that will be shown\r
4650          * @return      void\r
4651          */\r
4652         static public function error($msg)\r
4653         {\r
4654                 self::$headMess = $msg;\r
4655                 self::$skin->parse('adminerrorpage');\r
4656                 return;\r
4657         }\r
4658         \r
4659         /**\r
4660          * Admin::disallow()\r
4661          * add error log and show error page \r
4662          * \r
4663          * @param       void\r
4664          * @return      void\r
4665          */\r
4666         static public function disallow()\r
4667         {\r
4668                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4669                 self::error(_ERROR_DISALLOWED);\r
4670                 return;\r
4671         }\r
4672         \r
4673         /**\r
4674          * Admin::PluninAdminPagehead()\r
4675          * Output pluginadmin page head\r
4676          *\r
4677          * @param       string  $extrahead\r
4678          * @return      void\r
4679          */\r
4680         static public function PluninAdminPagehead($extrahead = '')\r
4681         {\r
4682                 self::$extrahead .= $extrahead;\r
4683                 self::$skin->parse('pagehead');\r
4684                 return;\r
4685         }\r
4686         \r
4687         /**\r
4688          * Admin::PluninAdminPagefoot()\r
4689          * Output pluginadmin page foot\r
4690          *\r
4691          * @param       void\r
4692          * @return      void\r
4693          */\r
4694         static public function PluninAdminPagefoot()\r
4695         {\r
4696                 self::$skin->parse('pagefoot');\r
4697                 return;\r
4698         }\r
4699         \r
4700         /**\r
4701          * Admin::action_bookmarklet()\r
4702          * \r
4703          * @param       void\r
4704          * @return      void\r
4705          */\r
4706         static private function action_bookmarklet()\r
4707         {\r
4708                 global $member, $manager;\r
4709                 \r
4710                 $blogid = intRequestVar('blogid');\r
4711                 $member->teamRights($blogid) or self::disallow();\r
4712                 \r
4713                 self::$skin->parse('bookmarklet');\r
4714                 return;\r
4715         }\r
4716         \r
4717         /**\r
4718          * Admin::action_actionlog()\r
4719          * \r
4720          * @param       void\r
4721          * @return      void\r
4722          */\r
4723         static private function action_actionlog()\r
4724         {\r
4725                 global $member, $manager;\r
4726                 \r
4727                 $member->isAdmin() or self::disallow();\r
4728                 \r
4729                 self::$skin->parse('actionlog');\r
4730                 return;\r
4731         }\r
4732         \r
4733         /**\r
4734          * Admin::action_banlist()\r
4735          * \r
4736          * @param       void\r
4737          * @return      void\r
4738          */\r
4739         static private function action_banlist()\r
4740         {\r
4741                 global $member, $manager;\r
4742                 \r
4743                 $blogid = intRequestVar('blogid');\r
4744                 $member->blogAdminRights($blogid) or self::disallow();\r
4745                 \r
4746                 self::$skin->parse('banlist');\r
4747                 return;\r
4748         }\r
4749         \r
4750         /**\r
4751          * Admin::action_banlistdelete()\r
4752          * \r
4753          * @param       void\r
4754          * @return      void\r
4755          */\r
4756         static private function action_banlistdelete()\r
4757         {\r
4758                 global $member, $manager;\r
4759                 \r
4760                 $blogid = intRequestVar('blogid');\r
4761                 $member->blogAdminRights($blogid) or self::disallow();\r
4762                 \r
4763                 self::$skin->parse('banlistdelete');\r
4764                 return;\r
4765         }\r
4766         \r
4767         /**\r
4768          * Admin::action_banlistdeleteconfirm()\r
4769          * \r
4770          * @param       void\r
4771          * @return      void\r
4772          */\r
4773         static private function action_banlistdeleteconfirm()\r
4774         {\r
4775                 global $member, $manager;\r
4776                 \r
4777                 $blogid         = intPostVar('blogid');\r
4778                 $allblogs       = postVar('allblogs');\r
4779                 $iprange        = postVar('iprange');\r
4780                 \r
4781                 $member->blogAdminRights($blogid) or self::disallow();\r
4782                 \r
4783                 $deleted = array();\r
4784                 \r
4785                 if ( !$allblogs )\r
4786                 {\r
4787                         if ( Ban::removeBan($blogid, $iprange) )\r
4788                         {\r
4789                                 $deleted[] = $blogid;\r
4790                         }\r
4791                 }\r
4792                 else\r
4793                 {\r
4794                         // get blogs fot which member has admin rights\r
4795                         $adminblogs = $member->getAdminBlogs();\r
4796                         foreach ($adminblogs as $blogje)\r
4797                         {\r
4798                                 if ( Ban::removeBan($blogje, $iprange) )\r
4799                                 {\r
4800                                         $deleted[] = $blogje;\r
4801                                 }\r
4802                         }\r
4803                 }\r
4804                 \r
4805                 if ( sizeof($deleted) == 0 )\r
4806                 {\r
4807                         self::error(_ERROR_DELETEBAN);\r
4808                 }\r
4809                 \r
4810                 /* TODO: we should use other ways */\r
4811                 $_REQUEST['delblogs'] = $deleted;\r
4812                 \r
4813                 self::$skin->parse('banlistdeleteconfirm');\r
4814                 return;\r
4815         }\r
4816         \r
4817         /**\r
4818          * Admin::action_banlistnewfromitem()\r
4819          * \r
4820          * @param       void\r
4821          * @return      void\r
4822          */\r
4823         static private function action_banlistnewfromitem()\r
4824         {\r
4825                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
4826                 return;\r
4827         }\r
4828         \r
4829         /**\r
4830          * Admin::action_banlistnew()\r
4831          * \r
4832          * @param       integer $blogid ID for weblog\r
4833          * @return      void\r
4834          */\r
4835         static private function action_banlistnew($blogid = '')\r
4836         {\r
4837                 global $member, $manager;\r
4838                 \r
4839                 if ( $blogid == '' )\r
4840                 {\r
4841                         $blogid = intRequestVar('blogid');\r
4842                 }\r
4843                 \r
4844                 $ip = requestVar('ip');\r
4845                 \r
4846                 $member->blogAdminRights($blogid) or self::disallow();\r
4847                 \r
4848                 /* TODO: we should consider to use the other way instead of this */\r
4849                 $_REQUEST['blogid'] = $blogid;          \r
4850                 \r
4851                 self::$skin->parse('banlistnew');\r
4852                 \r
4853                 return;\r
4854         }\r
4855 \r
4856         /**\r
4857          * Admin::action_banlistadd()\r
4858          * \r
4859          * @param       void\r
4860          * @return      void\r
4861          */\r
4862         static private function action_banlistadd()\r
4863         {\r
4864                 global $member;\r
4865                 \r
4866                 $blogid         = intPostVar('blogid');\r
4867                 $allblogs       = postVar('allblogs');\r
4868                 $iprange        = postVar('iprange');\r
4869                 \r
4870                 if ( $iprange == "custom" )\r
4871                 {\r
4872                         $iprange = postVar('customiprange');\r
4873                 }\r
4874                 $reason   = postVar('reason');\r
4875                 \r
4876                 $member->blogAdminRights($blogid) or self::disallow();\r
4877                 \r
4878                 // TODO: check IP range validity\r
4879                 \r
4880                 if ( !$allblogs )\r
4881                 {\r
4882                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4883                         {\r
4884                                 self::error(_ERROR_ADDBAN);\r
4885                         }\r
4886                 }\r
4887                 else\r
4888                 {\r
4889                         // get blogs fot which member has admin rights\r
4890                         $adminblogs = $member->getAdminBlogs();\r
4891                         $failed = 0;\r
4892                         foreach ($adminblogs as $blogje)\r
4893                         {\r
4894                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4895                                 {\r
4896                                         $failed = 1;\r
4897                                 }\r
4898                         }\r
4899                         if ( $failed )\r
4900                         {\r
4901                                 self::error(_ERROR_ADDBAN);\r
4902                         }\r
4903                 }\r
4904                 self::action_banlist();\r
4905                 return;\r
4906         }\r
4907         \r
4908         /**\r
4909          * Admin::action_clearactionlog()\r
4910          * \r
4911          * @param       void\r
4912          * @return      void\r
4913          */\r
4914         static private function action_clearactionlog()\r
4915         {\r
4916                 global $member;\r
4917                 \r
4918                 $member->isAdmin() or self::disallow();\r
4919                 \r
4920                 ActionLog::clear();\r
4921                 \r
4922                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4923                 return;\r
4924         }\r
4925         \r
4926         /**\r
4927          * Admin::action_backupoverview()\r
4928          * \r
4929          * @param       void\r
4930          * @return      void\r
4931          */\r
4932         static private function action_backupoverview()\r
4933         {\r
4934                 global $member, $manager;\r
4935                 \r
4936                 $member->isAdmin() or self::disallow();\r
4937                 \r
4938                 self::$skin->parse('backupoverview');\r
4939                 return;\r
4940         }\r
4941 \r
4942         /**\r
4943          * Admin::action_backupcreate()\r
4944          * create file for backup\r
4945          * \r
4946          * @param               void\r
4947          * @return      void\r
4948          * \r
4949          */\r
4950         static private function action_backupcreate()\r
4951         {\r
4952                 global $member, $DIR_LIBS;\r
4953                 \r
4954                 $member->isAdmin() or self::disallow();\r
4955                 \r
4956                 // use compression ?\r
4957                 $useGzip = (integer) postVar('gzip');\r
4958                 \r
4959                 include($DIR_LIBS . 'backup.php');\r
4960                 \r
4961                 // try to extend time limit\r
4962                 // (creating/restoring dumps might take a while)\r
4963                 @set_time_limit(1200);\r
4964                 \r
4965                 Backup::do_backup($useGzip);\r
4966                 exit;\r
4967         }\r
4968         \r
4969         /**\r
4970          * Admin::action_backuprestore()\r
4971          * restoring from uploaded file\r
4972          * \r
4973          * @param               void\r
4974          * @return      void\r
4975          */\r
4976         static private function action_backuprestore()\r
4977         {\r
4978                 global $member, $DIR_LIBS;\r
4979                 \r
4980                 $member->isAdmin() or self::disallow();\r
4981                 \r
4982                 if ( intPostVar('letsgo') != 1 )\r
4983                 {\r
4984                         self::error(_ERROR_BACKUP_NOTSURE);\r
4985                 }\r
4986                 \r
4987                 include($DIR_LIBS . 'backup.php');\r
4988                 \r
4989                 // try to extend time limit\r
4990                 // (creating/restoring dumps might take a while)\r
4991                 @set_time_limit(1200);\r
4992                 \r
4993                 $message = Backup::do_restore();\r
4994                 if ( $message != '' )\r
4995                 {\r
4996                         self::error($message);\r
4997                 }\r
4998                 self::$skin->parse('backuprestore');\r
4999                 return;\r
5000         }\r
5001         \r
5002         /**\r
5003          * Admin::action_pluginlist()\r
5004          * output the list of installed plugins\r
5005          * \r
5006          * @param       void\r
5007          * @return      void\r
5008          * \r
5009          */\r
5010         static private function action_pluginlist()\r
5011         {\r
5012                 global $DIR_PLUGINS, $member, $manager;\r
5013                 \r
5014                 // check if allowed\r
5015                 $member->isAdmin() or self::disallow();\r
5016                 \r
5017                 self::$skin->parse('pluginlist');\r
5018                 return;\r
5019         }\r
5020         \r
5021         /**\r
5022          * Admin::action_pluginhelp()\r
5023          * \r
5024          * @param       void\r
5025          * @return      void\r
5026          */\r
5027         static private function action_pluginhelp()\r
5028         {\r
5029                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5030                 \r
5031                 // check if allowed\r
5032                 $member->isAdmin() or self::disallow();\r
5033                 \r
5034                 $plugid = intGetVar('plugid');\r
5035                 \r
5036                 if ( !$manager->pidInstalled($plugid) )\r
5037                 {\r
5038                         self::error(_ERROR_NOSUCHPLUGIN);\r
5039                 }\r
5040                 \r
5041                 self::$skin->parse('pluginhelp');\r
5042                 return;\r
5043         }\r
5044         \r
5045         /**\r
5046          * Admin::action_pluginadd()\r
5047          * \r
5048          * @param       Void\r
5049          * @return      Void\r
5050          * \r
5051          */\r
5052         static private function action_pluginadd()\r
5053         {\r
5054                 global $member, $manager, $DIR_PLUGINS;\r
5055                 \r
5056                 // check if allowed\r
5057                 $member->isAdmin() or self::disallow();\r
5058                 \r
5059                 $name = postVar('filename');\r
5060                 \r
5061                 if ( $manager->pluginInstalled($name) )\r
5062                 {\r
5063                         self::error(_ERROR_DUPPLUGIN);\r
5064                 }\r
5065                 \r
5066                 if ( !checkPlugin($name) )\r
5067                 {\r
5068                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5069                 }\r
5070                 \r
5071                 // get number of currently installed plugins\r
5072                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5073                 $numCurrent = $res->rowCount();\r
5074                 \r
5075                 // plugin will be added as last one in the list\r
5076                 $newOrder = $numCurrent + 1;\r
5077                 \r
5078                 $data = array('file' => &$name);\r
5079                 $manager->notify('PreAddPlugin', $data);\r
5080                 \r
5081                 // do this before calling getPlugin (in case the plugin id is used there)\r
5082                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5083                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5084                 DB::execute($query);\r
5085                 $iPid = DB::getInsertId();\r
5086                 \r
5087                 $manager->clearCachedInfo('installedPlugins');\r
5088                 \r
5089                 // Load the plugin for condition checking and instalation\r
5090                 $plugin =& $manager->getPlugin($name);\r
5091                 \r
5092                 // check if it got loaded (could have failed)\r
5093                 if ( !$plugin )\r
5094                 {\r
5095                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5096                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5097                         \r
5098                         DB::execute($query);\r
5099                         \r
5100                         $manager->clearCachedInfo('installedPlugins');\r
5101                         self::error(_ERROR_PLUGIN_LOAD);\r
5102                 }\r
5103                 \r
5104                 // check if plugin needs a newer Nucleus version\r
5105                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5106                 {\r
5107                         // uninstall plugin again...\r
5108                         self::deleteOnePlugin($plugin->getID());\r
5109                         \r
5110                         // ...and show error\r
5111                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5112                 }\r
5113                 \r
5114                 // check if plugin needs a newer Nucleus version\r
5115                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5116                 {\r
5117                         // uninstall plugin again...\r
5118                         self::deleteOnePlugin($plugin->getID());\r
5119                         \r
5120                         // ...and show error\r
5121                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5122                 }\r
5123                 \r
5124                 $pluginList = $plugin->getPluginDep();\r
5125                 foreach ( $pluginList as $pluginName )\r
5126                 {\r
5127                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5128                         if ($res->rowCount() == 0)\r
5129                         {\r
5130                                 // uninstall plugin again...\r
5131                                 self::deleteOnePlugin($plugin->getID());\r
5132                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5133                         }\r
5134                 }\r
5135                 \r
5136                 // call the install method of the plugin\r
5137                 $plugin->install();\r
5138                 \r
5139                 $data = array('plugin' => &$plugin);\r
5140                 $manager->notify('PostAddPlugin', $data);\r
5141                 \r
5142                 // update all events\r
5143                 self::action_pluginupdate();\r
5144                 return;\r
5145         }\r
5146         \r
5147         /**\r
5148          * ADMIN:action_pluginupdate():\r
5149          * \r
5150          * @param       Void\r
5151          * @return      Void\r
5152          * \r
5153          */\r
5154         static private function action_pluginupdate()\r
5155         {\r
5156                 global $member, $manager, $CONF;\r
5157                 \r
5158                 // check if allowed\r
5159                 $member->isAdmin() or self::disallow();\r
5160                 \r
5161                 // delete everything from plugin_events\r
5162                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5163                 \r
5164                 // loop over all installed plugins\r
5165                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5166                 foreach ( $res as $row )\r
5167                 {\r
5168                         $pid  =  $row['pid'];\r
5169                         $plug =& $manager->getPlugin($row['pfile']);\r
5170                         if ( $plug )\r
5171                         {\r
5172                                 $eventList = $plug->getEventList();\r
5173                                 foreach ( $eventList as $eventName )\r
5174                                 {\r
5175                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5176                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5177                                         DB::execute($query);\r
5178                                 }\r
5179                         }\r
5180                 }\r
5181                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5182                 return;\r
5183         }\r
5184         \r
5185         /**\r
5186          * Admin::action_plugindelete()\r
5187          * \r
5188          * @param       void\r
5189          * @return      void\r
5190          */\r
5191         static private function action_plugindelete()\r
5192         {\r
5193                 global $member, $manager;\r
5194                 \r
5195                 // check if allowed\r
5196                 $member->isAdmin() or self::disallow();\r
5197                 \r
5198                 $pid = intGetVar('plugid');\r
5199                 \r
5200                 if ( !$manager->pidInstalled($pid) )\r
5201                 {\r
5202                         self::error(_ERROR_NOSUCHPLUGIN);\r
5203                 }\r
5204                 \r
5205                 self::$skin->parse('plugindelete');\r
5206                 return;\r
5207         }\r
5208 \r
5209         /**\r
5210          * Admin::action_plugindeleteconfirm()\r
5211          * \r
5212          * @param       void\r
5213          * @return      void\r
5214          */\r
5215         static private function action_plugindeleteconfirm()\r
5216         {\r
5217                 global $member, $manager, $CONF;\r
5218                 \r
5219                 // check if allowed\r
5220                 $member->isAdmin() or self::disallow();\r
5221                 \r
5222                 $pid = intPostVar('plugid');\r
5223                 \r
5224                 $error = self::deleteOnePlugin($pid, 1);\r
5225                 if ( $error )\r
5226                 {\r
5227                         self::error($error);\r
5228                 }\r
5229                 \r
5230                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5231                 return;\r
5232         }\r
5233         \r
5234         /**\r
5235          * Admin::\r
5236          * \r
5237          * @param       void\r
5238          * @return      void\r
5239          */\r
5240         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5241         {\r
5242                 global $manager;\r
5243                 \r
5244                 $pid = intval($pid);\r
5245                 \r
5246                 if ( !$manager->pidInstalled($pid) )\r
5247                 {\r
5248                         return _ERROR_NOSUCHPLUGIN;\r
5249                 }\r
5250                 \r
5251                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5252                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5253                 $name = DB::getValue($query);\r
5254                 \r
5255                 // check dependency before delete\r
5256                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5257                 foreach ( $res as $row )\r
5258                 {\r
5259                         $plug =& $manager->getPlugin($row['pfile']);\r
5260                         if ( $plug )\r
5261                         {\r
5262                                 $depList = $plug->getPluginDep();\r
5263                                 foreach ( $depList as $depName )\r
5264                                 {\r
5265                                         if ( $name == $depName )\r
5266                                         {\r
5267                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5268                                         }\r
5269                                 }\r
5270                         }\r
5271                 }\r
5272                 \r
5273                 $data = array('plugid' => $pid);\r
5274                 $manager->notify('PreDeletePlugin', $data);\r
5275                 \r
5276                 // call the unInstall method of the plugin\r
5277                 if ( $callUninstall )\r
5278                 {\r
5279                         $plugin =& $manager->getPlugin($name);\r
5280                         if ( $plugin )\r
5281                         {\r
5282                                 $plugin->unInstall();\r
5283                         }\r
5284                 }\r
5285                 \r
5286                 // delete all subscriptions\r
5287                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5288                 \r
5289                 // delete all options\r
5290                 // get OIDs from plugin_option_desc\r
5291                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5292                 $aOIDs = array();\r
5293                 foreach ( $res as $row )\r
5294                 {\r
5295                         array_push($aOIDs, $row['oid']);\r
5296                 }\r
5297                 \r
5298                 // delete from plugin_option and plugin_option_desc\r
5299                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5300                 if (count($aOIDs) > 0)\r
5301                 {\r
5302                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5303                 }\r
5304                 \r
5305                 // update order numbers\r
5306                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5307                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5308                 \r
5309                 // delete row\r
5310                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5311                 \r
5312                 $manager->clearCachedInfo('installedPlugins');\r
5313                 $data = array('plugid' => $pid);\r
5314                 $manager->notify('PostDeletePlugin', $data);\r
5315                 \r
5316                 return '';\r
5317         }\r
5318         \r
5319         /**\r
5320          * Admin::action_pluginup()\r
5321          * \r
5322          * @param       void\r
5323          * @return      void\r
5324          */\r
5325         static private function action_pluginup()\r
5326         {\r
5327                 global $member, $manager, $CONF;\r
5328                 \r
5329                 // check if allowed\r
5330                 $member->isAdmin() or self::disallow();\r
5331                 \r
5332                 $plugid = intGetVar('plugid');\r
5333                 \r
5334                 if ( !$manager->pidInstalled($plugid) )\r
5335                 {\r
5336                         self::error(_ERROR_NOSUCHPLUGIN);\r
5337                 }\r
5338                 \r
5339                 // 1. get old order number\r
5340                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5341                 \r
5342                 // 2. calculate new order number\r
5343                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5344                 \r
5345                 // 3. update plug numbers\r
5346                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5347                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5348                 \r
5349                 //self::action_pluginlist();\r
5350                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5351                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5352                 return;\r
5353         }\r
5354         \r
5355         /**\r
5356          * Admin::action_plugindown()\r
5357          * \r
5358          * @param       void\r
5359          * @return      void\r
5360          */\r
5361         static private function action_plugindown()\r
5362         {\r
5363                 global $member, $manager, $CONF;\r
5364                 \r
5365                 // check if allowed\r
5366                 $member->isAdmin() or self::disallow();\r
5367                 \r
5368                 $plugid = intGetVar('plugid');\r
5369                 if ( !$manager->pidInstalled($plugid) )\r
5370                 {\r
5371                         self::error(_ERROR_NOSUCHPLUGIN);\r
5372                 }\r
5373                 \r
5374                 // 1. get old order number\r
5375                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5376                 \r
5377                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5378                 $maxOrder = $res->rowCount();\r
5379                 \r
5380                 // 2. calculate new order number\r
5381                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5382                 \r
5383                 // 3. update plug numbers\r
5384                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5385                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5386                 \r
5387                 //self::action_pluginlist();\r
5388                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5389                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5390                 return;\r
5391         }\r
5392         \r
5393         /**\r
5394          * Admin::action_pluginoptions()\r
5395          * \r
5396          * Output Plugin option page\r
5397          * \r
5398          * @access      public\r
5399          * @param       string $message message when fallbacked\r
5400          * @return      void\r
5401          * \r
5402          */\r
5403         static private function action_pluginoptions($message = '')\r
5404         {\r
5405                 global $member, $manager;\r
5406                 \r
5407                 // check if allowed\r
5408                 $member->isAdmin() or self::disallow();\r
5409                 \r
5410                 $pid = intRequestVar('plugid');\r
5411                 if ( !$manager->pidInstalled($pid) )\r
5412                 {\r
5413                         self::error(_ERROR_NOSUCHPLUGIN);\r
5414                 }\r
5415                 \r
5416                 if ( isset($message) )\r
5417                 {\r
5418                         self::$headMess = $message;\r
5419                 }\r
5420                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5421                 \r
5422                 self::$skin->parse('pluginoptions');\r
5423                 return;\r
5424         }\r
5425         \r
5426         /**\r
5427          * Admin::action_pluginoptionsupdate()\r
5428          * \r
5429          * Update plugin options and fallback to plugin option page\r
5430          * \r
5431          * @access      public\r
5432          * @param       void\r
5433          * @return      void\r
5434          */\r
5435         static private function action_pluginoptionsupdate()\r
5436         {\r
5437                 global $member, $manager;\r
5438                 \r
5439                 // check if allowed\r
5440                 $member->isAdmin() or self::disallow();\r
5441                 \r
5442                 $pid = intRequestVar('plugid');\r
5443                 \r
5444                 if ( !$manager->pidInstalled($pid) )\r
5445                 {\r
5446                         self::error(_ERROR_NOSUCHPLUGIN);\r
5447                 }\r
5448                 \r
5449                 $aOptions = requestArray('plugoption');\r
5450                 NucleusPlugin::apply_plugin_options($aOptions);\r
5451                 \r
5452                 $data = array(\r
5453                         'context'       => 'global',\r
5454                         'plugid'        => $pid\r
5455                 );\r
5456                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5457                 \r
5458                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5459                 return;\r
5460         }\r
5461         \r
5462         /**\r
5463          * Admin::action_parseSpecialskin()\r
5464          * \r
5465          * @param       void\r
5466          * @return      void\r
5467          */\r
5468         static private function action_parseSpecialskin()\r
5469         {\r
5470                 self::$skin->parse(self::$action);\r
5471                 return;\r
5472         }\r
5473         \r
5474         /**\r
5475          * Admin::getAdminskinIDFromName()\r
5476          * \r
5477          * @param       string  $skinname       name of skin\r
5478          * @return      integer ID for skin\r
5479          */\r
5480         static private function getAdminskinIDFromName($skinname)\r
5481         {\r
5482                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5483                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5484                 $admnSknID      = DB::getValue($query);\r
5485                 return (integer) $adminSkinID;\r
5486         }\r
5487         \r
5488         /**\r
5489          * Admin::getAdminskinNameFromID()\r
5490          * \r
5491          * @param       integer $skinid ID for skin\r
5492          * @return      integer ID for skin\r
5493          */\r
5494         static private function getAdminskinNameFromID($skinid)\r
5495         {\r
5496                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5497                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5498                 $admnSknID      = DB::getValue($query);\r
5499                 return (integer) $adminSkinID;\r
5500         }\r
5501         \r
5502         /**\r
5503          * Admin::getAdminextrahead()\r
5504          */\r
5505         static public function getAdminextrahead()\r
5506         {\r
5507                 return self::$extrahead;\r
5508         }\r
5509         \r
5510         /**\r
5511          * Admin::getAdminpassvar()\r
5512          */\r
5513         static public function getAdminpassvar()\r
5514         {\r
5515                 return self::$passvar;\r
5516         }\r
5517         \r
5518         /**\r
5519          * Admin::getAdminAction()\r
5520          */\r
5521         static public function getAdminAction()\r
5522         {\r
5523                 return self::$action;\r
5524         }\r
5525         \r
5526         /**\r
5527          * Admin::getAdminaOption()\r
5528          */\r
5529         static public function getAdminaOption()\r
5530         {\r
5531                 return self::$aOptions;\r
5532         }\r
5533         \r
5534         /**\r
5535          * Admin::action_importAdmin()\r
5536          * \r
5537          * @param       void\r
5538          * @return      void\r
5539          */\r
5540         static private function action_importAdmin()\r
5541         {\r
5542                 global $DIR_ADMINSKINS, $action;\r
5543                 if ( $action == 'adminskinieimport' )\r
5544                 {\r
5545                         self::doAdminskinimport();\r
5546                 }\r
5547                 $skn = array();\r
5548                 if ( $action == 'showlogin' )\r
5549                 {\r
5550                         $skinName = 'showlogin';\r
5551                         $actnName = 'showlogin';\r
5552                 }\r
5553                 else\r
5554                 {\r
5555                         $skinName = 'defaultimporter';\r
5556                         $actnName = 'importAdmin';\r
5557                 }\r
5558                 \r
5559                 /* TODO: why??? */\r
5560                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5561                 $skn['id']                              = 0;\r
5562                 $skn['description']             = $skinName;\r
5563                 $skn['contentType']             = 'importAdmin';\r
5564                 $skn['includeMode']             = 'normal';\r
5565                 $skn['includePrefix']   = '';\r
5566                 $skn['name']                    = 'defaultinporter';\r
5567                 \r
5568                 self::$skin                             = (object) $skn;\r
5569                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5570                 \r
5571                 $parser = new PARSER($handler);\r
5572                 $parser->setSkin(self::$skin);\r
5573                 $parser->parse($contents);\r
5574                 \r
5575                 return;\r
5576         }\r
5577         \r
5578         /**\r
5579          * Admin::doAdminskinimport()\r
5580          * \r
5581          * @param       void\r
5582          * @return      void\r
5583          */\r
5584         static private function doAdminskinimport()\r
5585         {\r
5586                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5587                 \r
5588                 $member->isAdmin() or self::disallow();\r
5589                 \r
5590                 include_once($DIR_LIBS . 'Skinie.php');\r
5591                 $skinFileRaw    = postVar('skinfile');\r
5592                 $mode                   = postVar('mode');\r
5593                 $allowOverwrite = intPostVar('overwrite');\r
5594                 \r
5595                 if ( $mode == 'file' )\r
5596                 {\r
5597                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5598                 }\r
5599                 else\r
5600                 {\r
5601                         $skinFile = $skinFileRaw;\r
5602                 }\r
5603                 \r
5604                 $importer       = new SKINIMPORT();\r
5605                 $error          = $importer->readFile($skinFile);\r
5606                 if ( $error )\r
5607                 {\r
5608                         self::error($error);\r
5609                 }\r
5610                 $error = $importer->writeToDatabase($allowOverwrite);\r
5611                 if ( $error )\r
5612                 {\r
5613                         self::error($error);\r
5614                 }\r
5615                 \r
5616                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5617                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5618                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5619                 \r
5620                 header('Location: ' . $CONF['AdminURL']);\r
5621                 exit;\r
5622         }\r
5623 }\r