nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29         \r
  30         static public $headMess;\r
  31         \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $extrahead;\r
  35         static private $passvar;\r
  36         static private $aOptions;\r
  37         \r
  38         /**\r
  39          * Admin::$edit_actions\r
  40          */\r
  41         static private $edit_actions = array(\r
  42                 'adminskinoverview',\r
  43                 'adminskinieoverview',\r
  44                 'adminskinedittype',\r
  45                 'adminskinremovetype',\r
  46                 'adminskindelete',\r
  47                 'adminskinedit',\r
  48                 'adminskinieimport',\r
  49                 'adminskiniedoimport',\r
  50                 'admintemplateedit',\r
  51                 'admintemplateoverview',\r
  52                 'admintemplatedelete'\r
  53         );\r
  54         \r
  55         /**\r
  56          * Admin::$skinless_actions\r
  57          */\r
  58         static private $skinless_actions = array(\r
  59                 'plugindeleteconfirm',\r
  60                 'pluginoptionsupdate',\r
  61                 'skinremovetypeconfirm',\r
  62                 'skinclone',\r
  63                 'skindeleteconfirm',\r
  64                 'skinnew',\r
  65                 'skineditgeneral',\r
  66                 'skinieexport',\r
  67                 'skinupdate',\r
  68                 'templateupdate',\r
  69                 'templatedeleteconfirm',\r
  70                 'templatenew',\r
  71                 'templateclone',\r
  72                 'adminskinremovetypeconfirm',\r
  73                 'adminskinclone',\r
  74                 'adminskindeleteconfirm',\r
  75                 'adminskinnew',\r
  76                 'adminskineditgeneral',\r
  77                 'adminskinieexport',\r
  78                 'adminskinupdate',\r
  79                 'admintemplateupdate',\r
  80                 'admintemplatedeleteconfirm',\r
  81                 'admintemplatenew',\r
  82                 'admintemplateclone',\r
  83                 'blogsettingsupdate',\r
  84                 'settingsupdate',\r
  85                 'addnewlog2',\r
  86                 'additem',\r
  87                 'itemdeleteconfirm',\r
  88                 'itemupdate',\r
  89                 'changemembersettings',\r
  90                 'clearactionlog',\r
  91                 'memberedit'\r
  92         );\r
  93         \r
  94         static private $actions_needless_to_check = array(\r
  95                 'showlogin',\r
  96                 'login',\r
  97                 'overview',\r
  98                 'itemlist',\r
  99                 'blogcommentlist',\r
 100                 'bookmarklet',\r
 101                 'blogsettings',\r
 102                 'banlist',\r
 103                 'deleteblog',\r
 104                 'editmembersettings',\r
 105                 'browseownitems',\r
 106                 'browseowncomments',\r
 107                 'createitem',\r
 108                 'itemedit',\r
 109                 'itemmove',\r
 110                 'categoryedit',\r
 111                 'categorydelete',\r
 112                 'manage',\r
 113                 'actionlog',\r
 114                 'settingsedit',\r
 115                 'backupoverview',\r
 116                 'pluginlist',\r
 117                 'createnewlog',\r
 118                 'usermanagement',\r
 119                 'skinoverview',\r
 120                 'templateoverview',\r
 121                 'skinieoverview',\r
 122                 'itemcommentlist',\r
 123                 'commentedit',\r
 124                 'commentdelete',\r
 125                 'banlistnewfromitem',\r
 126                 'banlistdelete',\r
 127                 'itemdelete',\r
 128                 'manageteam',\r
 129                 'teamdelete',\r
 130                 'banlistnew',\r
 131                 'memberedit',\r
 132                 'memberdelete',\r
 133                 'pluginhelp',\r
 134                 'pluginoptions',\r
 135                 'plugindelete',\r
 136                 'skinedittype',\r
 137                 'skinremovetype',\r
 138                 'skindelete',\r
 139                 'skinedit',\r
 140                 'templateedit',\r
 141                 'templatedelete',\r
 142                 'activate',\r
 143                 'systemoverview',\r
 144                 'activatesetpwd',\r
 145         );\r
 146         \r
 147         static public function initialize()\r
 148         {\r
 149                 global $CONF, $DIR_LIBS;\r
 150                 \r
 151                 /* NOTE: 1. decide which skinid to use */\r
 152                 $skinid = $CONF['AdminSkin'];\r
 153                 /*\r
 154                  * NOTE: this is temporary escaped because not implemented yet\r
 155                 if (isset($member) && $member->isLoggedIn())\r
 156                 {\r
 157                         $memskin = $member->getAdminSkin();\r
 158                         if ( $memskin )\r
 159                         {\r
 160                                 $skinid = $memskin;\r
 161                         }\r
 162                 }\r
 163                 */\r
 164                 \r
 165                 /* NOTE: 2. make an instance of skin object */\r
 166                 if ( !Skin::existsID($skinid) )\r
 167                 {\r
 168                         return FALSE;\r
 169                 }\r
 170                 \r
 171                 /* NOTE: 3. initializing each members */\r
 172                 self::$skin                     = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
 173                 self::$action           = '';\r
 174                 self::$extrahead        = '';\r
 175                 self::$passvar          = '';\r
 176                 self::$headMess         = '';\r
 177                 self::$aOptions         = '';\r
 178                 return TRUE;\r
 179         }\r
 180         \r
 181         /**\r
 182          * Admin::action()\r
 183          * Executes an action\r
 184          *\r
 185          * @param       string  $action action to be performed\r
 186          * @return      void\r
 187          */\r
 188         static public function action($action)\r
 189         {\r
 190                 global $CONF, $DIR_LIBS, $manager, $member;\r
 191                 \r
 192                 /* 1. decide action name */\r
 193                 $customAction = postvar('customaction');\r
 194                 if ( !empty($customAction) )\r
 195                 {\r
 196                         $alias = array(\r
 197                                 'login' => $customAction,\r
 198                                 ''              => $customAction\r
 199                         );\r
 200                 }\r
 201                 else\r
 202                 {\r
 203                         $alias = array(\r
 204                                 'login' => 'overview',\r
 205                                 ''              => 'overview'\r
 206                         );\r
 207                 }\r
 208                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 209                 {\r
 210                         $action = $alias[$action];\r
 211                 }\r
 212                 $methodName = "action_{$action}";\r
 213                 self::$action = strtolower($action);\r
 214                 \r
 215                 /* 2. check the action */\r
 216                 $synonimActions = array(\r
 217                         'banlistnewfromitem',\r
 218                         'memberedit',\r
 219                         'login',\r
 220                 );\r
 221                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 222                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 223                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 224                 {\r
 225                         if (!$manager->checkTicket())\r
 226                         {\r
 227                                 self::error(_ERROR_BADTICKET);\r
 228                         }\r
 229                 }\r
 230 \r
 231                 /* 3. parse according to the action */\r
 232                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 233                 {\r
 234                         /* TODO: what is this?\r
 235                         self::action_parseSpecialskin();\r
 236                         */\r
 237                 }\r
 238                 elseif ( method_exists('Admin', $methodName) )\r
 239                 {\r
 240                         call_user_func(array(__CLASS__, $methodName));\r
 241                 }\r
 242                 else if ( self::existsSkinContents('adminerrorpage') )\r
 243                 {\r
 244                         self::error(_BADACTION . ENTITY::hsc($action));\r
 245                 }\r
 246                 elseif ( $id != $CONF['AdminSkin'] )\r
 247                 {\r
 248                         self::$skin = new Skin($CONF['AdminSkin']);\r
 249                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 250                         {\r
 251                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 252                         }\r
 253                 }\r
 254                 else\r
 255                 {\r
 256                         self::error(_BADACTION . ENTITY::hsc($action));\r
 257                 }\r
 258                 exit;\r
 259         }\r
 260         \r
 261         /**\r
 262          * Action::existsSkinContents()\r
 263          * Check skin contents\r
 264          *\r
 265          * @param       string  $action action type\r
 266          * @return      boolean\r
 267          */\r
 268         static private function existsSkinContents($action)\r
 269         {\r
 270                 $in_array  = in_array($action, self::$skinless_actions);\r
 271                 \r
 272                 if ( $in_array )\r
 273                 {\r
 274                         return $in_array;\r
 275                 }\r
 276                 else\r
 277                 {\r
 278                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 279                         /* TODO: skinid should be a default */\r
 280                         if ( !is_object(self::$skin) )\r
 281                         {\r
 282                                 global $CONF;\r
 283                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 284                         }\r
 285                         else\r
 286                         {\r
 287                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 288                         }\r
 289                 }\r
 290                 return;\r
 291         }\r
 292         \r
 293         /**\r
 294          * Action::specialActionsAllow()\r
 295          * Check exists specialskinparts\r
 296          *\r
 297          * @param       string  $action action type\r
 298          * @return boolean\r
 299          */\r
 300         static private function specialActionsAllow($action)\r
 301         {\r
 302                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 303                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 304                 return DB::getValue($query);\r
 305         }\r
 306         \r
 307         /**\r
 308          * Action::action_showlogin()\r
 309          * \r
 310          * @param       void\r
 311          * @return      void\r
 312          */\r
 313         static private function action_showlogin()\r
 314         {\r
 315                 global $error;\r
 316                 self::action_login($error);\r
 317                 return;\r
 318         }\r
 319         \r
 320         /**\r
 321          * Action::action_login()\r
 322          * \r
 323          * @param       string  $msg            message for pageheader\r
 324          * @param       integer $passvars       ???\r
 325          */\r
 326         static private function action_login($msg = '', $passvars = 1)\r
 327         {\r
 328                 global $member;\r
 329                 \r
 330                 // skip to overview when allowed\r
 331                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 332                 {\r
 333                         self::action_overview();\r
 334                         exit;\r
 335                 }\r
 336                 \r
 337                 /* TODO: needless variable??? */\r
 338                 self::$passvar = $passvars;\r
 339                 if ( $msg )\r
 340                 {\r
 341                         self::$headMess = $msg;\r
 342                 }\r
 343                 \r
 344                 self::pagehead();\r
 345                 self::$skin->parse('showlogin');\r
 346                 self::pagefoot();\r
 347         }\r
 348         \r
 349         /**\r
 350          * Action::action_overview()\r
 351          * provides a screen with the overview of the actions available\r
 352          * \r
 353          * @param       string  $msg    message for pageheader\r
 354          * @return      void\r
 355          */\r
 356         static private function action_overview($msg = '')\r
 357         {\r
 358                 if ( $msg )\r
 359                 {\r
 360                         self::$headMess = $msg;\r
 361                 }\r
 362                 \r
 363                 self::pagehead();\r
 364                 self::$skin->parse('overview');\r
 365                 self::pagefoot();\r
 366                 return;\r
 367         }\r
 368         \r
 369         /**\r
 370          * Admin::action_manage()\r
 371          * \r
 372          * @param       string  $msg    message for pageheader\r
 373          * @retrn       void\r
 374          */\r
 375         static private function action_manage($msg = '')\r
 376         {\r
 377                 global $member;\r
 378                 \r
 379                 if ( $msg )\r
 380                 {\r
 381                         self::$headMess = $msg;\r
 382                 }\r
 383                 $member->isAdmin() or self::disallow();\r
 384                 \r
 385                 self::pagehead();\r
 386                 self::$skin->parse('manage');\r
 387                 self::pagefoot();\r
 388                 return;\r
 389         }\r
 390         \r
 391         /**\r
 392          * Action::action_itemlist()\r
 393          * \r
 394          * @param       integer id for weblod\r
 395          * @return      void\r
 396          */\r
 397         static private function action_itemlist($blogid = '')\r
 398         {\r
 399                 global $member, $manager, $CONF;\r
 400                 \r
 401                 if ( $blogid == '' )\r
 402                 {\r
 403                         $blogid = intRequestVar('blogid');\r
 404                 }\r
 405                 \r
 406                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 407                 \r
 408                 self::pagehead();\r
 409                 self::$skin->parse('itemlist');\r
 410                 self::pagefoot();\r
 411                 return;\r
 412         }\r
 413         \r
 414         /**\r
 415          * Action::action_batchitem()\r
 416          * \r
 417          * @param       void\r
 418          * @return      void\r
 419          */\r
 420         static private function action_batchitem()\r
 421         {\r
 422                 global $member, $manager;\r
 423                 \r
 424                 $member->isLoggedIn() or self::disallow();\r
 425                 \r
 426                 $selected       = requestIntArray('batch');\r
 427                 $action         = requestVar('batchaction');\r
 428                 \r
 429                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 430                 {\r
 431                         self::error(_BATCH_NOSELECTION);\r
 432                 }\r
 433                 \r
 434                 // On move: when no destination blog/category chosen, show choice now\r
 435                 $destCatid = intRequestVar('destcatid');\r
 436                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 437                 {\r
 438                         self::batchMoveSelectDestination('item', $selected);\r
 439                 }\r
 440                 \r
 441                 // On delete: check if confirmation has been given\r
 442                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 443                 {\r
 444                         self::batchAskDeleteConfirmation('item', $selected);\r
 445                 }\r
 446                 \r
 447                 self::pagehead();\r
 448                 self::$skin->parse('batchitem');\r
 449                 self::pagefoot();\r
 450                 return;\r
 451         }\r
 452         \r
 453         /**\r
 454          * Action::action_batchcomment()\r
 455          * \r
 456          * @param       void\r
 457          * @return      void\r
 458          */\r
 459         static private function action_batchcomment()\r
 460         {\r
 461                 global $member;\r
 462                 \r
 463                 $member->isLoggedIn() or self::disallow();\r
 464                 \r
 465                 $selected       = requestIntArray('batch');\r
 466                 $action         = requestVar('batchaction');\r
 467                 \r
 468                 // Show error when no items were selected\r
 469                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 470                 {\r
 471                         self::error(_BATCH_NOSELECTION);\r
 472                 }\r
 473                 \r
 474                 // On delete: check if confirmation has been given\r
 475                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 476                 {\r
 477                         self::batchAskDeleteConfirmation('comment', $selected);\r
 478                 }\r
 479                 \r
 480                 self::pagehead();\r
 481                 self::$skin->parse('batchcomment');\r
 482                 self::pagefoot();\r
 483                 return;\r
 484         }\r
 485         \r
 486         /**\r
 487          * Admin::setAdminAction()\r
 488          *\r
 489          * @param       string  $action\r
 490          * @return      void\r
 491          */\r
 492         static public function setAdminAction($action)\r
 493         {\r
 494                 self::$action = $action;\r
 495                 return;\r
 496         }\r
 497         \r
 498         /**\r
 499          * Admin::action_batchmember()\r
 500          * \r
 501          * @param       void\r
 502          * @return      void\r
 503          */\r
 504         static private function action_batchmember()\r
 505         {\r
 506                 global $member;\r
 507                 \r
 508                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 509                 \r
 510                 $selected       = requestIntArray('batch');\r
 511                 $action         = requestVar('batchaction');\r
 512                 \r
 513                 // Show error when no members selected\r
 514                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 515                 {\r
 516                         self::error(_BATCH_NOSELECTION);\r
 517                 }\r
 518                 \r
 519                 // On delete: check if confirmation has been given\r
 520                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 521                 {\r
 522                         self::batchAskDeleteConfirmation('member',$selected);\r
 523                 }\r
 524                 \r
 525                 self::pagehead();\r
 526                 self::$skin->parse('batchmember');\r
 527                 self::pagefoot();\r
 528                 return;\r
 529         }\r
 530         \r
 531         /**\r
 532          * Admin::action_batchteam()\r
 533          * \r
 534          * @param       void\r
 535          * @return      void\r
 536          */\r
 537         static private function action_batchteam()\r
 538         {\r
 539                 global $member;\r
 540                 \r
 541                 $blogid = intRequestVar('blogid');\r
 542                 \r
 543                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 544                 \r
 545                 $selected       = requestIntArray('batch');\r
 546                 $action         = requestVar('batchaction');\r
 547                 \r
 548                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 549                 {\r
 550                         self::error(_BATCH_NOSELECTION);\r
 551                 }\r
 552                 \r
 553                 // On delete: check if confirmation has been given\r
 554                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 555                 {\r
 556                         self::batchAskDeleteConfirmation('team',$selected);\r
 557                 }\r
 558                 \r
 559                 self::pagehead();\r
 560                 self::$skin->parse('batchteam');\r
 561                 self::pagefoot();\r
 562                 return;\r
 563         }\r
 564         \r
 565         /**\r
 566          * Admin::action_batchcategory()\r
 567          * \r
 568          * @param       void\r
 569          * @return      void\r
 570          */\r
 571         static private function action_batchcategory()\r
 572         {\r
 573                 global $member, $manager;\r
 574                 \r
 575                 $member->isLoggedIn() or self::disallow();\r
 576                 \r
 577                 $selected       = requestIntArray('batch');\r
 578                 $action         = requestVar('batchaction');\r
 579                 \r
 580                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 581                 {\r
 582                         self::error(_BATCH_NOSELECTION);\r
 583                 }\r
 584                 \r
 585                 // On move: when no destination blog chosen, show choice now\r
 586                 $destBlogId = intRequestVar('destblogid');\r
 587                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 588                 {\r
 589                         self::batchMoveCategorySelectDestination('category', $selected);\r
 590                 }\r
 591                 \r
 592                 // On delete: check if confirmation has been given\r
 593                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 594                 {\r
 595                         self::batchAskDeleteConfirmation('category', $selected);\r
 596                 }\r
 597                 \r
 598                 self::pagehead();\r
 599                 self::$skin->parse('batchcategory');\r
 600                 self::pagefoot();\r
 601                 return;\r
 602         }\r
 603         \r
 604         /**\r
 605          * Admin::batchMoveSelectDestination()\r
 606          * \r
 607          * @param       string  $type   type of batch action\r
 608          * @param       integer $ids    needless???\r
 609          * @return      void\r
 610          * \r
 611          * TODO: remove needless argument\r
 612          */\r
 613         static private function batchMoveSelectDestination($type, $ids)\r
 614         {\r
 615                 $_POST['batchmove'] = $type;\r
 616                 self::pagehead();\r
 617                 self::$skin->parse('batchmove');\r
 618                 self::pagefoot();\r
 619                 return;\r
 620         }\r
 621         \r
 622         /**\r
 623          * Admin::batchMoveCategorySelectDestination()\r
 624          * \r
 625          * @param       string  $type   type of batch action\r
 626          * @param       integer $ids    needless???\r
 627          * @return      void\r
 628          * \r
 629          * TODO: remove needless argument\r
 630          */\r
 631         static private function batchMoveCategorySelectDestination($type, $ids)\r
 632         {\r
 633                 $_POST['batchmove'] = $type;\r
 634                 global $manager;\r
 635                 self::pagehead();\r
 636                 self::$skin->parse('batchmovecat');\r
 637                 self::pagefoot();\r
 638                 return;\r
 639         }\r
 640         \r
 641         /**\r
 642          * Admin::batchAskDeleteConfirmation()\r
 643          * \r
 644          * @param       string  $type   type of batch action\r
 645          * @param       integer $ids    needless???\r
 646          * @return      void\r
 647          * \r
 648          * TODO: remove needless argument\r
 649          */\r
 650         static private function batchAskDeleteConfirmation($type, $ids)\r
 651         {\r
 652                 self::pagehead();\r
 653                 self::$skin->parse('batchdelete');\r
 654                 self::pagefoot();\r
 655                 return;\r
 656         }\r
 657         \r
 658         /**\r
 659          * Admin::selectBlogCategory()\r
 660          * Inserts a HTML select element with choices for all categories to which the current\r
 661          * member has access\r
 662          *\r
 663          * @see function selectBlog\r
 664          * @param       string  $name                           name of weblod\r
 665          * @param       integer $selected                       \r
 666          * @param       integer $tabindex                       \r
 667          * @param       integer $showNewCat                     \r
 668          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 669          * @return      void\r
 670          *\r
 671          * NOTE: callback from AdminAction\r
 672          */\r
 673         static public function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 674         {\r
 675                 Admin::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);\r
 676                 return;\r
 677         }\r
 678         \r
 679         /**\r
 680          * Admin::selectBlog()\r
 681          * Inserts a HTML select element with choices for all blogs to which the user has access\r
 682          *      mode = 'blog' => shows blognames and values are blogids\r
 683          *      mode = 'category' => show category names and values are catids\r
 684          *\r
 685          * @param       string  $name                           name of weblod\r
 686          * @param       string  $mode                           \r
 687          * @param       integer $selected                       \r
 688          * @param       integer $tabindex                       \r
 689          * @param       integer $showNewCat                     \r
 690          * @param       integer $iForcedBlogInclude     ID for weblog always included\r
 691          * @param $iForcedBlogInclude\r
 692          *      ID of a blog that always needs to be included, without checking if the\r
 693          *      member is on the blog team (-1 = none)\r
 694          * @return      void\r
 695          */\r
 696         static public function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1)\r
 697         {\r
 698                 global $member, $CONF;\r
 699                 \r
 700                 // 0. get IDs of blogs to which member can post items (+ forced blog)\r
 701                 $aBlogIds = array();\r
 702                 if ( $iForcedBlogInclude != -1 )\r
 703                 {\r
 704                         $aBlogIds[] = intval($iForcedBlogInclude);\r
 705                 }\r
 706                 \r
 707                 if ( $member->isAdmin() && array_key_exists('ShowAllBlogs', $CONF) && $CONF['ShowAllBlogs'] )\r
 708                 {\r
 709                         $query =  "SELECT bnumber FROM %s ORDER BY bname;";\r
 710                         $query = sprintf($query, sql_table('blog'));\r
 711                 }\r
 712                 else\r
 713                 {\r
 714                         $query =  "SELECT bnumber FROM %s, %s WHERE tblog=bnumber AND tmember=%d;";\r
 715                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
 716                 }\r
 717                 \r
 718                 $rblogids = DB::getResult($query);\r
 719                 foreach ( $rblogids as $row )\r
 720                 {\r
 721                         if ( $row['bnumber'] != $iForcedBlogInclude )\r
 722                         {\r
 723                                 $aBlogIds[] = intval($row['bnumber']);\r
 724                         }\r
 725                 }\r
 726                 \r
 727                 if ( count($aBlogIds) == 0 )\r
 728                 {\r
 729                         return;\r
 730                 }\r
 731                 \r
 732                 /* TODO: we should consider to use the other way instead of this */\r
 733                 $_REQUEST['selectData'] = array(\r
 734                         'name'                  => $name,\r
 735                         'tabindex'              => $tabindex,\r
 736                         'mode'                  => $mode,\r
 737                         'selected'              => $selected,\r
 738                         'showNewCat'    => $showNewCat,\r
 739                         'aBlogIds'              => $aBlogIds,\r
 740                 );\r
 741                 self::$skin->parse('blogselectbox');\r
 742                 return;\r
 743         }\r
 744         \r
 745         /**\r
 746          * Admin::action_browseownitems()\r
 747          * \r
 748          * @param       void\r
 749          * @return      void\r
 750          */\r
 751         static private function action_browseownitems()\r
 752         {\r
 753                 global $member, $manager, $CONF;\r
 754                 \r
 755                 self::pagehead();\r
 756                 self::$skin->parse('browseownitems');\r
 757                 self::pagefoot();\r
 758                 return;\r
 759         }\r
 760         \r
 761         /**\r
 762          * Admin::action_itemcommentlist()\r
 763          * Show all the comments for a given item\r
 764          * \r
 765          * @param       integer $itemid ID for item\r
 766          * @return      void\r
 767          */\r
 768         static private function action_itemcommentlist($itemid = '')\r
 769         {\r
 770                 global $member, $manager, $CONF;\r
 771                 \r
 772                 if ( $itemid == '' )\r
 773                 {\r
 774                         $itemid = intRequestVar('itemid');\r
 775                 }\r
 776                 \r
 777                 /* TODO: we consider to use the other way insterad of this */\r
 778                 $_REQUEST['itemid'] = $itemid;\r
 779                 $_REQUEST['blogid'] = getBlogIdFromItemId($itemid);\r
 780                 \r
 781                 // only allow if user is allowed to alter item\r
 782                 $member->canAlterItem($itemid) or self::disallow();\r
 783                 \r
 784                 $blogid = getBlogIdFromItemId($itemid);\r
 785                 \r
 786                 self::pagehead();\r
 787                 self::$skin->parse('itemcommentlist');\r
 788                 self::pagefoot();\r
 789                 return;\r
 790         }\r
 791         \r
 792         /**\r
 793          * Admin::action_browseowncomments()\r
 794          * Browse own comments\r
 795          * \r
 796          * @param       void\r
 797          * @return      void\r
 798          */\r
 799         static private function action_browseowncomments()\r
 800         {\r
 801                 self::pagehead();\r
 802                 self::$skin->parse('browseowncomments');\r
 803                 self::pagefoot();\r
 804                 return;\r
 805         }\r
 806         \r
 807         /**\r
 808          * Admin::action_blogcommentlist()\r
 809          * Browse all comments for a weblog\r
 810          * \r
 811          * @param       integer $blogid ID for weblog\r
 812          * @return      void\r
 813          */\r
 814         static private function action_blogcommentlist($blogid = '')\r
 815         {\r
 816                 global $member, $manager, $CONF;\r
 817                 \r
 818                 if ( $blogid == '' )\r
 819                 {\r
 820                         $blogid = intRequestVar('blogid');\r
 821                 }\r
 822                 else\r
 823                 {\r
 824                         $blogid = intval($blogid);\r
 825                 }\r
 826                 \r
 827                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 828                 \r
 829                 /* TODO: we consider to use the other way insterad of this */\r
 830                 $_REQUEST['blogid'] = $blogid;\r
 831                 \r
 832                 self::pagehead();\r
 833                 self::$skin->parse('blogcommentlist');\r
 834                 self::pagefoot();\r
 835                 return;\r
 836         }\r
 837         \r
 838         /**\r
 839          * Admin::action_createitem()\r
 840          * Provide a page to item a new item to the given blog\r
 841          * \r
 842          * @param       void\r
 843          * @return      void\r
 844          */\r
 845         static private function action_createitem()\r
 846         {\r
 847                 global $member, $manager;\r
 848                 \r
 849                 $blogid = intRequestVar('blogid');\r
 850                 \r
 851                 // check if allowed\r
 852                 $member->teamRights($blogid) or self::disallow();\r
 853                 \r
 854                 $memberid = $member->getID();\r
 855                 \r
 856                 $blog =& $manager->getBlog($blogid);\r
 857                 \r
 858                 self::pagehead();\r
 859                 self::$skin->parse('createitem');\r
 860                 self::pagefoot();\r
 861                 return;\r
 862         }\r
 863         \r
 864         /**\r
 865          * Admin::action_itemedit()\r
 866          * \r
 867          * @param       void\r
 868          * @return      void\r
 869          */\r
 870         static private function action_itemedit()\r
 871         {\r
 872                 global $member, $manager;\r
 873                 \r
 874                 $itemid = intRequestVar('itemid');\r
 875                 \r
 876                 // only allow if user is allowed to alter item\r
 877                 $member->canAlterItem($itemid) or self::disallow();\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $blogid = getBlogIDFromItemID($itemid);\r
 881                 $item   =& $manager->getItem($itemid, 1, 1);\r
 882                 $manager->notify(\r
 883                                 'PrepareItemForEdit',\r
 884                                 array(\r
 885                                                 'item' => &$item\r
 886                                 )\r
 887                 );\r
 888                 \r
 889                 self::pagehead();\r
 890                 self::$skin->parse('itemedit');\r
 891                 self::pagefoot();\r
 892                 return;\r
 893         }\r
 894         \r
 895         /**\r
 896          * Admin::action_itemupdate()\r
 897          * \r
 898          * @param       void\r
 899          * @return      void\r
 900          */\r
 901         static private function action_itemupdate()\r
 902         {\r
 903                 global $member, $manager, $CONF;\r
 904                 \r
 905                 $itemid = intRequestVar('itemid');\r
 906                 $catid  = postVar('catid');\r
 907                 \r
 908                 // only allow if user is allowed to alter item\r
 909                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 910                 \r
 911                 $actiontype = postVar('actiontype');\r
 912                 \r
 913                 // delete actions are handled by itemdelete (which has confirmation)\r
 914                 if ( $actiontype == 'delete' )\r
 915                 {\r
 916                         self::action_itemdelete();\r
 917                         return;\r
 918                 }\r
 919                 \r
 920                 $body           = postVar('body');\r
 921                 $title          = postVar('title');\r
 922                 $more           = postVar('more');\r
 923                 $closed         = intPostVar('closed');\r
 924                 $draftid        = intPostVar('draftid');\r
 925                 \r
 926                 // default action = add now\r
 927                 if ( !$actiontype )\r
 928                 {\r
 929                         $actiontype='addnow';\r
 930                 }\r
 931                 \r
 932                 // create new category if needed\r
 933                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 934                 {\r
 935                         // get blogid\r
 936                         list($blogid) = sscanf($catid,"newcat-%d");\r
 937                         \r
 938                         // create\r
 939                         $blog =& $manager->getBlog($blogid);\r
 940                         $catid = $blog->createNewCategory();\r
 941                         \r
 942                         // show error when sth goes wrong\r
 943                         if ( !$catid )\r
 944                         {\r
 945                                 self::doError(_ERROR_CATCREATEFAIL);\r
 946                         }\r
 947                 }\r
 948                 \r
 949                 /*\r
 950                         set some variables based on actiontype\r
 951 \r
 952                         actiontypes:\r
 953                                 draft items -> addnow, addfuture, adddraft, delete\r
 954                                 non-draft items -> edit, changedate, delete\r
 955 \r
 956                         variables set:\r
 957                                 $timestamp: set to a nonzero value for future dates or date changes\r
 958                                 $wasdraft: set to 1 when the item used to be a draft item\r
 959                                 $publish: set to 1 when the edited item is not a draft\r
 960          */\r
 961                 $blogid =  getBlogIDFromItemID($itemid);\r
 962                 $blog   =& $manager->getBlog($blogid);\r
 963                 \r
 964                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 965                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 966                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 967                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 968                 {\r
 969                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 970                 }\r
 971                 else\r
 972                 {\r
 973                         $timestamp =0;\r
 974                 }\r
 975                 \r
 976                 // edit the item for real\r
 977                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 978                 \r
 979                 self::updateFuturePosted($blogid);\r
 980                 \r
 981                 if ( $draftid > 0 )\r
 982                 {\r
 983                         // delete permission is checked inside Item::delete()\r
 984                         Item::delete($draftid);\r
 985                 }\r
 986                 \r
 987                 if ( $catid != intPostVar('catid') )\r
 988                 {\r
 989                         self::action_categoryedit(\r
 990                                 $catid,\r
 991                                 $blog->getID(),\r
 992                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 993                         );\r
 994                 }\r
 995                 else\r
 996                 {\r
 997                         // TODO: set start item correctly for itemlist\r
 998                         $item = Item::getItem($itemid, 0, 0);\r
 999                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
1000                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
1001                         $cnt  = DB::getValue($query);\r
1002                         $_REQUEST['start'] = $cnt + 1;\r
1003                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
1004                 }\r
1005                 return;\r
1006         }\r
1007         \r
1008         /**\r
1009          * Admin::action_itemdelete()\r
1010          * Delete item\r
1011          * \r
1012          * @param       Void\r
1013          * @return      Void\r
1014          */\r
1015         static private function action_itemdelete()\r
1016         {\r
1017                 global $member, $manager;\r
1018                 \r
1019                 $itemid = intRequestVar('itemid');\r
1020                 \r
1021                 // only allow if user is allowed to alter item\r
1022                 $member->canAlterItem($itemid) or self::disallow();\r
1023                 \r
1024                 if ( !$manager->existsItem($itemid,1,1) )\r
1025                 {\r
1026                         self::error(_ERROR_NOSUCHITEM);\r
1027                 }\r
1028                 \r
1029                 self::pagehead();\r
1030                 self::$skin->parse('itemdelete');\r
1031                 self::pagefoot();\r
1032                 return;\r
1033         }\r
1034         \r
1035         /**\r
1036          * Admin::action_itemdeleteconfirm()\r
1037          * \r
1038          * @param       void\r
1039          * @return      void\r
1040          */\r
1041         static private function action_itemdeleteconfirm()\r
1042         {\r
1043                 global $member;\r
1044                 \r
1045                 $itemid = intRequestVar('itemid');\r
1046                 \r
1047                 // only allow if user is allowed to alter item\r
1048                 $member->canAlterItem($itemid) or self::disallow();\r
1049                 \r
1050                 // get blogid first\r
1051                 $blogid = getBlogIdFromItemId($itemid);\r
1052                 \r
1053                 // delete item (note: some checks will be performed twice)\r
1054                 self::deleteOneItem($itemid);\r
1055                 \r
1056                 self::action_itemlist($blogid);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::deleteOneItem()\r
1062          * Deletes one item and returns error if something goes wrong\r
1063          * \r
1064          * @param       integer $itemid ID for item\r
1065          * @return      void\r
1066          */\r
1067         static public function deleteOneItem($itemid)\r
1068         {\r
1069                 global $member, $manager;\r
1070                 \r
1071                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1072                 if ( !$member->canAlterItem($itemid) )\r
1073                 {\r
1074                         return _ERROR_DISALLOWED;\r
1075                 }\r
1076                 \r
1077                 // need to get blogid before the item is deleted\r
1078                 $blogid = getBlogIDFromItemId($itemid);\r
1079                 \r
1080                 $manager->loadClass('ITEM');\r
1081                 Item::delete($itemid);\r
1082                 \r
1083                 // update blog's futureposted\r
1084                 self::updateFuturePosted($blogid);\r
1085                 return;\r
1086         }\r
1087         \r
1088         /**\r
1089          * Admin::updateFuturePosted()\r
1090          * Update a blog's future posted flag\r
1091          * \r
1092          * @param integer $blogid\r
1093          * @return      void\r
1094          */\r
1095         static private function updateFuturePosted($blogid)\r
1096         {\r
1097                 global $manager;\r
1098                 \r
1099                 $blogid                 =  intval($blogid);\r
1100                 $blog                   =& $manager->getBlog($blogid);\r
1101                 $currenttime    =  $blog->getCorrectTime(time());\r
1102                 \r
1103                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1104                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1105                 $result = DB::getResult($query);\r
1106                 \r
1107                 if ( $result->rowCount() > 0 )\r
1108                 {\r
1109                                 $blog->setFuturePost();\r
1110                 }\r
1111                 else\r
1112                 {\r
1113                                 $blog->clearFuturePost();\r
1114                 }\r
1115                 return;\r
1116         }\r
1117 \r
1118         /**\r
1119          * Admin::action_itemmove()\r
1120          * \r
1121          * @param       void\r
1122          * @return      void\r
1123          */\r
1124         static private function action_itemmove()\r
1125         {\r
1126                 global $member, $manager;\r
1127                 \r
1128                 $itemid = intRequestVar('itemid');\r
1129                 \r
1130                 $member->canAlterItem($itemid) or self::disallow();\r
1131                 \r
1132                 self::pagehead();\r
1133                 self::$skin->parse('itemmove');\r
1134                 self::pagefoot();\r
1135                 return;\r
1136         }\r
1137         \r
1138         /**\r
1139          * Admin::action_itemmoveto()\r
1140          * \r
1141          * @param       void\r
1142          * @return      void\r
1143          */\r
1144         static private function action_itemmoveto()\r
1145         {\r
1146                 global $member, $manager;\r
1147                 \r
1148                 $itemid = intRequestVar('itemid');\r
1149                 $catid = requestVar('catid');\r
1150                 \r
1151                 // create new category if needed\r
1152                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1153                 {\r
1154                         // get blogid\r
1155                         list($blogid) = sscanf($catid,'newcat-%d');\r
1156                         \r
1157                         // create\r
1158                         $blog =& $manager->getBlog($blogid);\r
1159                         $catid = $blog->createNewCategory();\r
1160                         \r
1161                         // show error when sth goes wrong\r
1162                         if ( !$catid )\r
1163                         {\r
1164                                 self::doError(_ERROR_CATCREATEFAIL);\r
1165                         }\r
1166                 }\r
1167                 \r
1168                 // only allow if user is allowed to alter item\r
1169                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1170                 \r
1171                 $old_blogid = getBlogIDFromItemId($itemid);\r
1172                 \r
1173                 Item::move($itemid, $catid);\r
1174                 \r
1175                 // set the futurePosted flag on the blog\r
1176                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1177                 \r
1178                 // reset the futurePosted in case the item is moved from one blog to another\r
1179                 self::updateFuturePosted($old_blogid);\r
1180                 \r
1181                 if ( $catid != intRequestVar('catid') )\r
1182                 {\r
1183                         self::action_categoryedit($catid, $blog->getID());\r
1184                 }\r
1185                 else\r
1186                 {\r
1187                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1188                 }\r
1189                 return;\r
1190         }\r
1191         \r
1192         /**\r
1193          * Admin::moveOneItem()\r
1194          * Moves one item to a given category (category existance should be checked by caller)\r
1195          * errors are returned\r
1196          * \r
1197          * @param       integer $itemid         ID for item\r
1198          * @param       integer $destCatid      ID for category to which the item will be moved\r
1199          * @return      void\r
1200          */\r
1201         static private function moveOneItem($itemid, $destCatid)\r
1202         {\r
1203                 global $member;\r
1204                 \r
1205                 // only allow if user is allowed to move item\r
1206                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1207                 {\r
1208                         return _ERROR_DISALLOWED;\r
1209                 }\r
1210                 \r
1211                 Item::move($itemid, $destCatid);\r
1212                 return;\r
1213         }\r
1214         \r
1215         /**\r
1216          * Admin::action_additem()\r
1217          * Adds a item to the chosen blog\r
1218          * \r
1219          * @param       void\r
1220          * @return      void\r
1221          */\r
1222         static private function action_additem()\r
1223         {\r
1224                 global $manager, $CONF;\r
1225                 \r
1226                 $manager->loadClass('ITEM');\r
1227                 \r
1228                 $result = Item::createFromRequest();\r
1229                 \r
1230                 if ( $result['status'] == 'error' )\r
1231                 {\r
1232                         self::error($result['message']);\r
1233                 }\r
1234                 \r
1235                 $itemid = (integer) $result['itemid'];\r
1236                 \r
1237                 $blogid         =  (integer) getBlogIDFromItemID($itemid);\r
1238                 \r
1239                 if ( $result['status'] == 'newcategory' )\r
1240                 {\r
1241                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $blogid);\r
1242                         self::action_categoryedit($result['catid'], $blogid, $distURI);\r
1243                 }\r
1244                 else\r
1245                 {\r
1246                         $methodName = 'action_itemlist';\r
1247                         self::action_itemlist($blogid);\r
1248                 }\r
1249                 return;\r
1250         }\r
1251         \r
1252         /**\r
1253          * Admin::action_commentedit()\r
1254          * Allows to edit previously made comments\r
1255          * \r
1256          * @param       void\r
1257          * @return      void\r
1258          */\r
1259         static private function action_commentedit()\r
1260         {\r
1261                 global $member, $manager;\r
1262                 \r
1263                 $commentid = intRequestVar('commentid');\r
1264                 \r
1265                 $member->canAlterComment($commentid) or self::disallow();\r
1266                 \r
1267                 self::pagehead();\r
1268                 self::$skin->parse('commentedit');\r
1269                 self::pagefoot();\r
1270                 return;\r
1271         }\r
1272         \r
1273         /**\r
1274          * Admin::action_commentupdate()\r
1275          * \r
1276          * @param       void\r
1277          * @return      void\r
1278          */\r
1279         static private function action_commentupdate()\r
1280         {\r
1281                 global $member, $manager;\r
1282                 \r
1283                 $commentid = intRequestVar('commentid');\r
1284                 \r
1285                 $member->canAlterComment($commentid) or self::disallow();\r
1286                 \r
1287                 $url    = postVar('url');\r
1288                 $email  = postVar('email');\r
1289                 $body   = postVar('body');\r
1290                 \r
1291                 // intercept words that are too long\r
1292                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1293                 {\r
1294                         self::error(_ERROR_COMMENT_LONGWORD);\r
1295                 }\r
1296                 \r
1297                 // check length\r
1298                 if ( i18n::strlen($body) < 3 )\r
1299                 {\r
1300                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1301                 }\r
1302                 \r
1303                 if ( i18n::strlen($body) > 5000 )\r
1304                 {\r
1305                         self::error(_ERROR_COMMENT_TOOLONG);\r
1306                 }\r
1307                 \r
1308                 // prepare body\r
1309                 $body = Comment::prepareBody($body);\r
1310                 \r
1311                 // call plugins\r
1312                 $data = array(\r
1313                         'body' => &$body\r
1314                 );\r
1315                 $manager->notify('PreUpdateComment', $data);\r
1316                 \r
1317                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1318                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1319                 DB::execute($query);\r
1320                 \r
1321                 // get itemid\r
1322                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1323                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1324                 \r
1325                 $itemid = DB::getValue($query);\r
1326                 \r
1327                 if ( $member->canAlterItem($itemid) )\r
1328                 {\r
1329                         self::action_itemcommentlist($itemid);\r
1330                 }\r
1331                 else\r
1332                 {\r
1333                         self::action_browseowncomments();\r
1334                 }\r
1335                 return;\r
1336         }\r
1337         \r
1338         /**\r
1339          * Admin::action_commentdelete()\r
1340          * Update comment\r
1341          * \r
1342          * @param       void\r
1343          * @return      void\r
1344          */\r
1345         static private function action_commentdelete()\r
1346         {\r
1347                 global $member, $manager;\r
1348                 \r
1349                 $commentid = intRequestVar('commentid');\r
1350                 $member->canAlterComment($commentid) or self::disallow();\r
1351                 \r
1352                 self::pagehead();\r
1353                 self::$skin->parse('commentdelete');\r
1354                 self::pagefoot();\r
1355                 return;\r
1356         }\r
1357         \r
1358         /**\r
1359          * Admin::action_commentdeleteconfirm()\r
1360          * \r
1361          * @param       void\r
1362          * @return      void\r
1363          */\r
1364         static private function action_commentdeleteconfirm()\r
1365         {\r
1366                 global $member;\r
1367                 \r
1368                 $commentid = intRequestVar('commentid');\r
1369                 \r
1370                 // get item id first\r
1371                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1372                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1373                 \r
1374                 $itemid = DB::getValue($query);\r
1375                 \r
1376                 $error = self::deleteOneComment($commentid);\r
1377                 if ( $error )\r
1378                 {\r
1379                         self::doError($error);\r
1380                 }\r
1381                 \r
1382                 if ( $member->canAlterItem($itemid) )\r
1383                 {\r
1384                         self::action_itemcommentlist($itemid);\r
1385                 }\r
1386                 else\r
1387                 {\r
1388                         self::action_browseowncomments();\r
1389                 }\r
1390                 return;\r
1391         }\r
1392         \r
1393         /**\r
1394          * Admin::deleteOneComment()\r
1395          * \r
1396          * @param       integer $commentid      ID for comment\r
1397          * @return      void\r
1398          */\r
1399         static public function deleteOneComment($commentid)\r
1400         {\r
1401                 global $member, $manager;\r
1402                 \r
1403                 $commentid = (integer) $commentid;\r
1404                 \r
1405                 if ( !$member->canAlterComment($commentid) )\r
1406                 {\r
1407                         return _ERROR_DISALLOWED;\r
1408                 }\r
1409                 \r
1410                 $data = array(\r
1411                         'commentid' => $commentid\r
1412                 );\r
1413                 \r
1414                 $manager->notify('PreDeleteComment', $data);\r
1415                 \r
1416                 // delete the comments associated with the item\r
1417                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1418                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1419                 DB::execute($query);\r
1420                 \r
1421                 $data = array(\r
1422                         'commentid' => $commentid\r
1423                 );\r
1424                 \r
1425                 $manager->notify('PostDeleteComment', $data);\r
1426                 \r
1427                 return '';\r
1428         }\r
1429         \r
1430         /**\r
1431          * Admin::action_usermanagement()\r
1432          * Usermanagement main\r
1433          * \r
1434          * @param       void\r
1435          * @return      void\r
1436          */\r
1437         static private function action_usermanagement()\r
1438         {\r
1439                 global $member, $manager;\r
1440                 \r
1441                 // check if allowed\r
1442                 $member->isAdmin() or self::disallow();\r
1443                 \r
1444                 self::pagehead();\r
1445                 self::$skin->parse('usermanagement');\r
1446                 self::pagefoot();\r
1447                 return;\r
1448         }\r
1449         \r
1450         /**\r
1451          * Admin::action_memberedit()\r
1452          * Edit member settings\r
1453          * \r
1454          * @param       void\r
1455          * @return      void\r
1456          */\r
1457         static private function action_memberedit()\r
1458         {\r
1459                 self::action_editmembersettings(intRequestVar('memberid'));\r
1460                 return;\r
1461         }\r
1462         \r
1463         /**\r
1464          * Admin::action_editmembersettings()\r
1465          * \r
1466          * @param       integer $memberid       ID for member\r
1467          * @return      void\r
1468          * \r
1469          */\r
1470         static private function action_editmembersettings($memberid = '')\r
1471         {\r
1472                 global $member, $manager, $CONF;\r
1473                 \r
1474                 if ( $memberid == '' )\r
1475                 {\r
1476                         $memberid = $member->getID();\r
1477                 }\r
1478                 \r
1479                 /* TODO: we should consider to use the other way insterad of this */\r
1480                 $_REQUEST['memberid'] = $memberid;\r
1481                 \r
1482                 // check if allowed\r
1483                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1484                 \r
1485                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
1486                 self::pagehead($extrahead);\r
1487                 self::$skin->parse('editmembersettings');\r
1488                 self::pagefoot();\r
1489                 return;\r
1490         }\r
1491         \r
1492         /**\r
1493          * Admin::action_changemembersettings()\r
1494          * \r
1495          * @param       void\r
1496          * @return      void\r
1497          */\r
1498         static private function action_changemembersettings()\r
1499         {\r
1500                 global $member, $CONF, $manager;\r
1501                 \r
1502                 $memberid = intRequestVar('memberid');\r
1503                 \r
1504                 // check if allowed\r
1505                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1506                 \r
1507                 $name                   = trim(strip_tags(postVar('name')));\r
1508                 $realname               = trim(strip_tags(postVar('realname')));\r
1509                 $password               = postVar('password');\r
1510                 $repeatpassword = postVar('repeatpassword');\r
1511                 $email                  = strip_tags(postVar('email'));\r
1512                 $url                    = strip_tags(postVar('url'));\r
1513                 $adminskin              = intPostVar('adminskin');\r
1514                 \r
1515                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1516                 if ( !preg_match('#^https?://#', $url) )\r
1517                 {\r
1518                         $url = 'http://' . $url;\r
1519                 }\r
1520                 \r
1521                 $admin          = postVar('admin');\r
1522                 $canlogin       = postVar('canlogin');\r
1523                 $notes          = strip_tags(postVar('notes'));\r
1524                 $locale         = postVar('locale');\r
1525                 \r
1526                 $mem = Member::createFromID($memberid);\r
1527                 \r
1528                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1529                 {\r
1530                         if ( !isValidDisplayName($name) )\r
1531                         {\r
1532                                 self::error(_ERROR_BADNAME);\r
1533                         }\r
1534                         \r
1535                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1536                         {\r
1537                                 self::error(_ERROR_NICKNAMEINUSE);\r
1538                         }\r
1539                         \r
1540                         if ( $password != $repeatpassword )\r
1541                         {\r
1542                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1543                         }\r
1544                         \r
1545                         if ( $password && (i18n::strlen($password) < 6) )\r
1546                         {\r
1547                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1548                         }\r
1549                                 \r
1550                         if ( $password )\r
1551                         {\r
1552                                 $pwdvalid = true;\r
1553                                 $pwderror = '';\r
1554                                 \r
1555                                 $data = array(\r
1556                                         'password'     => $password,\r
1557                                         'errormessage' => &$pwderror,\r
1558                                         'valid'        => &$pwdvalid\r
1559                                 );\r
1560                                 $manager->notify('PrePasswordSet', $data);\r
1561                                 \r
1562                                 if ( !$pwdvalid )\r
1563                                 {\r
1564                                         self::error($pwderror);\r
1565                                 }\r
1566                         }\r
1567                 }\r
1568                 \r
1569                 if ( !NOTIFICATION::address_validation($email) )\r
1570                 {\r
1571                         self::error(_ERROR_BADMAILADDRESS);\r
1572                 }\r
1573                 if ( !$realname )\r
1574                 {\r
1575                         self::error(_ERROR_REALNAMEMISSING);\r
1576                 }\r
1577                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1578                 {\r
1579                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1580                 }\r
1581                 \r
1582                 // check if there will remain at least one site member with both the logon and admin rights\r
1583                 // (check occurs when taking away one of these rights from such a member)\r
1584                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1585                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1586                         )\r
1587                 {\r
1588                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1589                         if ( $r->rowCount() < 2 )\r
1590                         {\r
1591                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1592                         }\r
1593                 }\r
1594                 \r
1595                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1596                 {\r
1597                         $mem->setDisplayName($name);\r
1598                         if ( $password )\r
1599                         {\r
1600                                 $mem->setPassword($password);\r
1601                         }\r
1602                 }\r
1603                 \r
1604                 $oldEmail = $mem->getEmail();\r
1605                 \r
1606                 $mem->setRealName($realname);\r
1607                 $mem->setEmail($email);\r
1608                 $mem->setURL($url);\r
1609                 $mem->setNotes($notes);\r
1610                 $mem->setLocale($locale);\r
1611                 \r
1612                 // only allow super-admins to make changes to the admin status\r
1613                 if ( $member->isAdmin() )\r
1614                 {\r
1615                         $mem->setAdmin($admin);\r
1616                         $mem->setCanLogin($canlogin);\r
1617                 }\r
1618                 \r
1619                 $autosave = postVar('autosave');\r
1620                 $mem->setAutosave($autosave);\r
1621                 \r
1622                 $mem->write();\r
1623                 \r
1624                 // store plugin options\r
1625                 $aOptions = requestArray('plugoption');\r
1626                 NucleusPlugin::apply_plugin_options($aOptions);\r
1627                 $data = array(\r
1628                         'context'  => 'member',\r
1629                         'memberid' => $memberid,\r
1630                         'member'   => &$mem\r
1631                 );\r
1632                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1633                 \r
1634                 // if email changed, generate new password\r
1635                 if ( $oldEmail != $mem->getEmail() )\r
1636                 {\r
1637                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1638                         // logout member\r
1639                         $mem->newCookieKey();\r
1640                         \r
1641                         // only log out if the member being edited is the current member.\r
1642                         if ( $member->getID() == $memberid )\r
1643                         {\r
1644                                 $member->logout();\r
1645                         }\r
1646                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1647                         return;\r
1648                 }\r
1649                 \r
1650                 if ( ($mem->getID() == $member->getID())\r
1651                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1652                 {\r
1653                         $mem->newCookieKey();\r
1654                         $member->logout();\r
1655                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1656                 }\r
1657                 else\r
1658                 {\r
1659                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1660                 }\r
1661                 return;\r
1662         }\r
1663 \r
1664         /**\r
1665          * Admin::action_memberadd()\r
1666          * \r
1667          * @param       void\r
1668          * @return      void\r
1669          * \r
1670          */\r
1671         static private function action_memberadd()\r
1672         {\r
1673                 global $member, $manager;\r
1674                 \r
1675                 // check if allowed\r
1676                 $member->isAdmin() or self::disallow();\r
1677                 \r
1678                 if ( postVar('password') != postVar('repeatpassword') )\r
1679                 {\r
1680                         self::error(_ERROR_PASSWORDMISMATCH);\r
1681                 }\r
1682                 \r
1683                 if ( i18n::strlen(postVar('password')) < 6 )\r
1684                 {\r
1685                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1686                 }\r
1687                 \r
1688                 $res = Member::create(\r
1689                         postVar('name'),\r
1690                         postVar('realname'),\r
1691                         postVar('password'),\r
1692                         postVar('email'),\r
1693                         postVar('url'),\r
1694                         postVar('admin'),\r
1695                         postVar('canlogin'),\r
1696                         postVar('notes')\r
1697                 );\r
1698                 \r
1699                 if ( $res != 1 )\r
1700                 {\r
1701                         self::error($res);\r
1702                 }\r
1703                 \r
1704                 // fire PostRegister event\r
1705                 $newmem = new Member();\r
1706                 $newmem->readFromName(postVar('name'));\r
1707                 $data = array(\r
1708                         'member' => &$newmem\r
1709                 );\r
1710                 $manager->notify('PostRegister', $data);\r
1711                 \r
1712                 self::action_usermanagement();\r
1713                 return;\r
1714         }\r
1715         \r
1716         /**\r
1717          * Admin::action_activate()\r
1718          * Account activation\r
1719          * \r
1720          * @param       void\r
1721          * @return      void\r
1722          */\r
1723         static private function action_activate()\r
1724         {\r
1725                 $key = getVar('key');\r
1726                 self::showActivationPage($key);\r
1727                 return;\r
1728         }\r
1729         \r
1730         /**\r
1731          * Admin::showActivationPage()\r
1732          * \r
1733          * @param       void\r
1734          * @return      void\r
1735          */\r
1736         static private function showActivationPage($key, $message = '')\r
1737         {\r
1738                 global $manager;\r
1739                 \r
1740                 // clean up old activation keys\r
1741                 Member::cleanupActivationTable();\r
1742                 \r
1743                 // get activation info\r
1744                 $info = Member::getActivationInfo($key);\r
1745                 \r
1746                 if ( !$info )\r
1747                 {\r
1748                         self::error(_ERROR_ACTIVATE);\r
1749                 }\r
1750                 \r
1751                 $mem = Member::createFromId($info->vmember);\r
1752                 \r
1753                 if ( !$mem )\r
1754                 {\r
1755                         self::error(_ERROR_ACTIVATE);\r
1756                 }\r
1757                 \r
1758                 /* TODO: we should consider to use the other way insterad of this */\r
1759                 $_POST['ackey']                                 = $key;\r
1760                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1761                 \r
1762                 self::$headMess = $message;\r
1763                 self::pagehead();\r
1764                 self::$skin->parse('activate');\r
1765                 self::pagefoot();\r
1766                 return;\r
1767         }\r
1768         \r
1769         /**\r
1770          * Admin::action_activatesetpwd()\r
1771          * Account activation - set password part\r
1772          * \r
1773          * @param       void\r
1774          * @return      void\r
1775          */\r
1776         static private function action_activatesetpwd()\r
1777         {\r
1778                 global $manager;\r
1779                 $key = postVar('key');\r
1780                 \r
1781                 // clean up old activation keys\r
1782                 Member::cleanupActivationTable();\r
1783                 \r
1784                 // get activation info\r
1785                 $info = Member::getActivationInfo($key);\r
1786                 \r
1787                 if ( !$info || ($info->type == 'addresschange') )\r
1788                 {\r
1789                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1790                 }\r
1791                 \r
1792                 $mem = Member::createFromId($info->vmember);\r
1793                 \r
1794                 if ( !$mem )\r
1795                 {\r
1796                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1797                 }\r
1798                 \r
1799                 $password               = postVar('password');\r
1800                 $repeatpassword = postVar('repeatpassword');\r
1801                 \r
1802                 if ( $password != $repeatpassword )\r
1803                 {\r
1804                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1805                 }\r
1806                 \r
1807                 if ( $password && (i18n::strlen($password) < 6) )\r
1808                 {\r
1809                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1810                 }\r
1811                         \r
1812                 if ( $password )\r
1813                 {\r
1814                         $pwdvalid = true;\r
1815                         $pwderror = '';\r
1816                         \r
1817                         $data = array(\r
1818                                 'password'              => $password,\r
1819                                 'errormessage'  => &$pwderror,\r
1820                                 'valid'                 => &$pwdvalid\r
1821                         );\r
1822                         $manager->notify('PrePasswordSet', $data);\r
1823                         if ( !$pwdvalid )\r
1824                         {\r
1825                                 return self::showActivationPage($key,$pwderror);\r
1826                         }\r
1827                 }\r
1828                 \r
1829                 $error = '';\r
1830                 \r
1831                 $data = array(\r
1832                         'type'   => 'activation',\r
1833                         'member' => $mem,\r
1834                         'error'  => &$error\r
1835                 );\r
1836                 $manager->notify('ValidateForm', $data);\r
1837                 if ( $error != '' )\r
1838                 {\r
1839                         return self::showActivationPage($key, $error);\r
1840                 }\r
1841                 \r
1842                 // set password\r
1843                 $mem->setPassword($password);\r
1844                 $mem->write();\r
1845                 \r
1846                 // do the activation\r
1847                 Member::activate($key);\r
1848                 \r
1849                 self::pagehead();\r
1850                 self::$skin->parse('activatesetpwd');\r
1851                 self::pagefoot();\r
1852                 return;\r
1853         }\r
1854         \r
1855         /**\r
1856          * Admin::action_manageteam()\r
1857          * Manage team\r
1858          * \r
1859          * @param       void\r
1860          * @return      void\r
1861          */\r
1862         static private function action_manageteam()\r
1863         {\r
1864                 global $member, $manager;\r
1865                 \r
1866                 $blogid = intRequestVar('blogid');\r
1867                 \r
1868                 // check if allowed\r
1869                 $member->blogAdminRights($blogid) or self::disallow();\r
1870                 \r
1871                 self::pagehead();\r
1872                 self::$skin->parse('manageteam');\r
1873                 self::pagefoot();\r
1874                 return;\r
1875         }\r
1876         \r
1877         /**\r
1878          * Admin::action_teamaddmember()\r
1879          * Add member to team\r
1880          * \r
1881          * @param       void\r
1882          * @return      void\r
1883          */\r
1884         static private function action_teamaddmember()\r
1885         {\r
1886                 global $member, $manager;\r
1887                 \r
1888                 $memberid       = intPostVar('memberid');\r
1889                 $blogid         = intPostVar('blogid');\r
1890                 $admin          = intPostVar('admin');\r
1891                 \r
1892                 // check if allowed\r
1893                 $member->blogAdminRights($blogid) or self::disallow();\r
1894                 \r
1895                 $blog =& $manager->getBlog($blogid);\r
1896                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1897                 {\r
1898                         self::error(_ERROR_ALREADYONTEAM);\r
1899                 }\r
1900                 \r
1901                 self::action_manageteam();\r
1902                 return;\r
1903         }\r
1904         \r
1905         /**\r
1906          * Admin::action_teamdelete()\r
1907          * \r
1908          * @param       void\r
1909          * @return      void\r
1910          */\r
1911         static private function action_teamdelete()\r
1912         {\r
1913                 global $member, $manager;\r
1914                 \r
1915                 $memberid       = intRequestVar('memberid');\r
1916                 $blogid         = intRequestVar('blogid');\r
1917                 \r
1918                 // check if allowed\r
1919                 $member->blogAdminRights($blogid) or self::disallow();\r
1920                 \r
1921                 $teammem =  Member::createFromID($memberid);\r
1922                 $blog =& $manager->getBlog($blogid);\r
1923                 \r
1924                 self::pagehead();\r
1925                 self::$skin->parse('teamdelete');\r
1926                 self::pagefoot();\r
1927                 return;\r
1928         }\r
1929         \r
1930         /**\r
1931          * Admin::action_teamdeleteconfirm()\r
1932          * \r
1933          * @param       void\r
1934          * @return      void\r
1935          */\r
1936         static private function action_teamdeleteconfirm()\r
1937         {\r
1938                 global $member;\r
1939                 \r
1940                 $memberid = intRequestVar('memberid');\r
1941                 $blogid = intRequestVar('blogid');\r
1942                 \r
1943                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1944                 if ( $error )\r
1945                 {\r
1946                         self::error($error);\r
1947                 }\r
1948                 self::action_manageteam();\r
1949                 return;\r
1950         }\r
1951         \r
1952         /**\r
1953          * Admin::deleteOneTeamMember()\r
1954          * \r
1955          * @param       void\r
1956          * @return      void\r
1957          */\r
1958         static public function deleteOneTeamMember($blogid, $memberid)\r
1959         {\r
1960                 global $member, $manager;\r
1961                 \r
1962                 $blogid   = intval($blogid);\r
1963                 $memberid = intval($memberid);\r
1964                 \r
1965                 // check if allowed\r
1966                 if ( !$member->blogAdminRights($blogid) )\r
1967                 {\r
1968                         return _ERROR_DISALLOWED;\r
1969                 }\r
1970                 \r
1971                 // check if: - there remains at least one blog admin\r
1972                 //           - (there remains at least one team member)\r
1973                 $tmem = Member::createFromID($memberid);\r
1974                 \r
1975                 \r
1976                 $data = array(\r
1977                         'member' => &$tmem,\r
1978                         'blogid' => $blogid\r
1979                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1980                 \r
1981                 if ( $tmem->isBlogAdmin($blogid) )\r
1982                 {\r
1983                         /* TODO: why we did double check? */\r
1984                         // check if there are more blog members left and at least one admin\r
1985                         // (check for at least two admins before deletion)\r
1986                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1987                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1988                         $r     = DB::getResult($query);\r
1989                         if ( $r->rowCount() < 2 )\r
1990                         {\r
1991                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1992                         }\r
1993                 }\r
1994                 \r
1995                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1996                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1997                 DB::execute($query);\r
1998                 \r
1999                 $data = array(\r
2000                         'member' => &$tmem,\r
2001                         'blogid' => $blogid\r
2002                 );\r
2003                 $manager->notify('PostDeleteTeamMember', $data);\r
2004                 \r
2005                 return '';\r
2006         }\r
2007         \r
2008         /**\r
2009          * Admin::action_teamchangeadmin()\r
2010          * \r
2011          * @param       void\r
2012          * @return      void\r
2013          */\r
2014         static private function action_teamchangeadmin()\r
2015         {\r
2016                 global $member;\r
2017                 \r
2018                 $blogid         = intRequestVar('blogid');\r
2019                 $memberid       = intRequestVar('memberid');\r
2020                 \r
2021                 // check if allowed\r
2022                 $member->blogAdminRights($blogid) or self::disallow();\r
2023                 \r
2024                 $mem = Member::createFromID($memberid);\r
2025                 \r
2026                 // don't allow when there is only one admin at this moment\r
2027                 if ( $mem->isBlogAdmin($blogid) )\r
2028                 {\r
2029                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
2030                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
2031                         $r = DB::getResult($query);\r
2032                         if ( $r->rowCount() == 1 )\r
2033                         {\r
2034                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2035                         }\r
2036                 }\r
2037                 \r
2038                 if ( $mem->isBlogAdmin($blogid) )\r
2039                 {\r
2040                         $newval = 0;\r
2041                 }\r
2042                 else\r
2043                 {\r
2044                         $newval = 1;\r
2045                 }\r
2046                 \r
2047                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2048                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2049                 DB::execute($query);\r
2050                 \r
2051                 // only show manageteam if member did not change its own admin privileges\r
2052                 if ( $member->isBlogAdmin($blogid) )\r
2053                 {\r
2054                         self::action_manageteam();\r
2055                 }\r
2056                 else\r
2057                 {\r
2058                         self::action_overview(_MSG_ADMINCHANGED);\r
2059                 }\r
2060                 return;\r
2061         }\r
2062         \r
2063         /**\r
2064          * Admin::action_blogsettings()\r
2065          * \r
2066          * @param       void\r
2067          * @return      void\r
2068          */\r
2069         static private function action_blogsettings()\r
2070         {\r
2071                 global $member, $manager;\r
2072                 \r
2073                 $blogid = intRequestVar('blogid');\r
2074                 \r
2075                 // check if allowed\r
2076                 $member->blogAdminRights($blogid) or self::disallow();\r
2077                 \r
2078                 $blog =& $manager->getBlog($blogid);\r
2079                 \r
2080                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2081                 self::pagehead($extrahead);\r
2082                 self::$skin->parse('blogsettings');\r
2083                 self::pagefoot();\r
2084                 return;\r
2085         }\r
2086         \r
2087         /**\r
2088          * Admin::action_categorynew()\r
2089          * \r
2090          * @param       void\r
2091          * @return      void\r
2092          */\r
2093         static private function action_categorynew()\r
2094         {\r
2095                 global $member, $manager;\r
2096                 \r
2097                 $blogid = intRequestVar('blogid');\r
2098                 \r
2099                 $member->blogAdminRights($blogid) or self::disallow();\r
2100                 \r
2101                 $cname = postVar('cname');\r
2102                 $cdesc = postVar('cdesc');\r
2103                 \r
2104                 if ( !isValidCategoryName($cname) )\r
2105                 {\r
2106                         self::error(_ERROR_BADCATEGORYNAME);\r
2107                 }\r
2108                 \r
2109                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2110                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2111                 $res = DB::getResult($query);\r
2112                 if ( $res->rowCount() > 0 )\r
2113                 {\r
2114                         self::error(_ERROR_DUPCATEGORYNAME);\r
2115                 }\r
2116                 \r
2117                 $blog           =& $manager->getBlog($blogid);\r
2118                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2119                 \r
2120                 self::action_blogsettings();\r
2121                 return;\r
2122         }\r
2123         \r
2124         /**\r
2125          * Admin::action_categoryedit()\r
2126          * \r
2127          * @param       void\r
2128          * @return      void\r
2129          */\r
2130         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2131         {\r
2132                 global $member, $manager;\r
2133                 \r
2134                 if ( $blogid == '' )\r
2135                 {\r
2136                         $blogid = intGetVar('blogid');\r
2137                 }\r
2138                 else\r
2139                 {\r
2140                         $blogid = intval($blogid);\r
2141                 }\r
2142                 if ( $catid == '' )\r
2143                 {\r
2144                         $catid = intGetVar('catid');\r
2145                 }\r
2146                 else\r
2147                 {\r
2148                         $catid = intval($catid);\r
2149                 }\r
2150                 \r
2151                 /* TODO: we should consider to use the other way insterad of this */\r
2152                 $_REQUEST['blogid']             = $blogid;\r
2153                 $_REQUEST['catid']              = $catid;\r
2154                 $_REQUEST['desturl']    = $desturl;\r
2155                 $member->blogAdminRights($blogid) or self::disallow();\r
2156                 \r
2157                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';\r
2158                 self::pagehead($extrahead);\r
2159                 self::$skin->parse('categoryedit');\r
2160                 self::pagefoot();\r
2161                 return;\r
2162         }\r
2163         \r
2164         /**\r
2165          * Admin::action_categoryupdate()\r
2166          * \r
2167          * @param       void\r
2168          * @return      void\r
2169          */\r
2170         static private function action_categoryupdate()\r
2171         {\r
2172                 global $member, $manager;\r
2173                 \r
2174                 $blogid         = intPostVar('blogid');\r
2175                 $catid          = intPostVar('catid');\r
2176                 $cname          = postVar('cname');\r
2177                 $cdesc          = postVar('cdesc');\r
2178                 $desturl        = postVar('desturl');\r
2179                 \r
2180                 $member->blogAdminRights($blogid) or self::disallow();\r
2181                 \r
2182                 if ( !isValidCategoryName($cname) )\r
2183                 {\r
2184                         self::error(_ERROR_BADCATEGORYNAME);\r
2185                 }\r
2186                 \r
2187                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2188                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2189                 $res    = DB::getResult($query);\r
2190                 if ( $res->rowCount() > 0 )\r
2191                 {\r
2192                         self::error(_ERROR_DUPCATEGORYNAME);\r
2193                 }\r
2194                 \r
2195                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2196                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2197                 DB::execute($query);\r
2198                 \r
2199                 // store plugin options\r
2200                 $aOptions = requestArray('plugoption');\r
2201                 NucleusPlugin::apply_plugin_options($aOptions);\r
2202                 $data = array(\r
2203                         'context'       => 'category',\r
2204                         'catid'         => $catid\r
2205                 );\r
2206                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2207                 \r
2208                 if ( $desturl )\r
2209                 {\r
2210                         redirect($desturl);\r
2211                         exit;\r
2212                 }\r
2213                 else\r
2214                 {\r
2215                         self::action_blogsettings();\r
2216                 }\r
2217                 return;\r
2218         }\r
2219         \r
2220         /**\r
2221          * Admin::action_categorydelete()\r
2222          * \r
2223          * @param       void\r
2224          * @return      void\r
2225          */\r
2226         static private function action_categorydelete()\r
2227         {\r
2228                 global $member, $manager;\r
2229                 \r
2230                 $blogid = intRequestVar('blogid');\r
2231                 $catid  = intRequestVar('catid');\r
2232                 \r
2233                 $member->blogAdminRights($blogid) or self::disallow();\r
2234                 \r
2235                 $blog =& $manager->getBlog($blogid);\r
2236                 \r
2237                 // check if the category is valid\r
2238                 if ( !$blog->isValidCategory($catid) )\r
2239                 {\r
2240                         self::error(_ERROR_NOSUCHCATEGORY);\r
2241                 }\r
2242                 \r
2243                 // don't allow deletion of default category\r
2244                 if ( $blog->getDefaultCategory() == $catid )\r
2245                 {\r
2246                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2247                 }\r
2248                 \r
2249                 // check if catid is the only category left for blogid\r
2250                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2251                 $query = sprintf($query, sql_table('category'), $blogid);\r
2252                 $res = DB::getResult($query);\r
2253                 if ( $res->rowCount() == 1 )\r
2254                 {\r
2255                         self::error(_ERROR_DELETELASTCATEGORY);\r
2256                 }\r
2257                 \r
2258                 self::pagehead();\r
2259                 self::$skin->parse('categorydelete');\r
2260                 self::pagefoot();\r
2261                 return;\r
2262         }\r
2263         \r
2264         /**\r
2265          * Admin::action_categorydeleteconfirm()\r
2266          * \r
2267          * @param       void\r
2268          * @return      void\r
2269          */\r
2270         static private function action_categorydeleteconfirm()\r
2271         {\r
2272                 global $member, $manager;\r
2273                 \r
2274                 $blogid = intRequestVar('blogid');\r
2275                 $catid  = intRequestVar('catid');\r
2276                 \r
2277                 $member->blogAdminRights($blogid) or self::disallow();\r
2278                 \r
2279                 $error = self::deleteOneCategory($catid);\r
2280                 if ( $error )\r
2281                 {\r
2282                         self::error($error);\r
2283                 }\r
2284                 \r
2285                 self::action_blogsettings();\r
2286                 return;\r
2287         }\r
2288         \r
2289         /**\r
2290          * Admin::deleteOneCategory()\r
2291          * Delete a category by its id\r
2292          * \r
2293          * @param       String  $catid  category id for deleting\r
2294          * @return      Void\r
2295          */\r
2296         static public function deleteOneCategory($catid)\r
2297         {\r
2298                 global $manager, $member;\r
2299                 \r
2300                 $catid  = intval($catid);\r
2301                 $blogid = getBlogIDFromCatID($catid);\r
2302                 \r
2303                 if ( !$member->blogAdminRights($blogid) )\r
2304                 {\r
2305                         return ERROR_DISALLOWED;\r
2306                 }\r
2307                 \r
2308                 // get blog\r
2309                 $blog =& $manager->getBlog($blogid);\r
2310                 \r
2311                 // check if the category is valid\r
2312                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2313                 {\r
2314                         return _ERROR_NOSUCHCATEGORY;\r
2315                 }\r
2316                 \r
2317                 $destcatid = $blog->getDefaultCategory();\r
2318                 \r
2319                 // don't allow deletion of default category\r
2320                 if ( $blog->getDefaultCategory() == $catid )\r
2321                 {\r
2322                         return _ERROR_DELETEDEFCATEGORY;\r
2323                 }\r
2324                 \r
2325                 // check if catid is the only category left for blogid\r
2326                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2327                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2328                 \r
2329                 $res = DB::getResult($query);\r
2330                 if ( $res->rowCount() == 1 )\r
2331                 {\r
2332                         return _ERROR_DELETELASTCATEGORY;\r
2333                 }\r
2334                 \r
2335                 $data = array('catid' => $catid);\r
2336                 $manager->notify('PreDeleteCategory', $data);\r
2337                 \r
2338                 // change category for all items to the default category\r
2339                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2340                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2341                 DB::execute($query);\r
2342                 \r
2343                 // delete all associated plugin options\r
2344                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2345                 \r
2346                 // delete category\r
2347                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2348                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2349                 DB::execute($query);\r
2350                 \r
2351                 $data = array('catid' => $catid);\r
2352                 $manager->notify('PostDeleteCategory', $data);\r
2353                 return;\r
2354         }\r
2355         \r
2356         /**\r
2357          * Admin::moveOneCategory()\r
2358          * Delete a category by its id\r
2359          * \r
2360          * @param       int     $catid          category id for move\r
2361          * @param       int     $destblogid     blog id for destination\r
2362          * @return      void\r
2363          */\r
2364         static public function moveOneCategory($catid, $destblogid)\r
2365         {\r
2366                 global $manager, $member;\r
2367                 $catid      = intval($catid);\r
2368                 $destblogid = intval($destblogid);\r
2369                 $blogid     = getBlogIDFromCatID($catid);\r
2370                 // mover should have admin rights on both blogs\r
2371                 if (!$member->blogAdminRights($blogid)) {\r
2372                         return _ERROR_DISALLOWED;\r
2373                 }\r
2374                 if (!$member->blogAdminRights($destblogid)) {\r
2375                         return _ERROR_DISALLOWED;\r
2376                 }\r
2377                 // cannot move to self\r
2378                 if ($blogid == $destblogid) {\r
2379                         return _ERROR_MOVETOSELF;\r
2380                 }\r
2381                 // get blogs\r
2382                 $blog     =& $manager->getBlog($blogid);\r
2383                 $destblog =& $manager->getBlog($destblogid);\r
2384                 // check if the category is valid\r
2385                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2386                         return _ERROR_NOSUCHCATEGORY;\r
2387                 }\r
2388                 // don't allow default category to be moved\r
2389                 if ($blog->getDefaultCategory() == $catid) {\r
2390                         return _ERROR_MOVEDEFCATEGORY;\r
2391                 }\r
2392                 $manager->notify(\r
2393                                 'PreMoveCategory',\r
2394                                 array(\r
2395                                                 'catid'      => &$catid,\r
2396                                                 'sourceblog' => &$blog,\r
2397                                                 'destblog'   => &$destblog\r
2398                                 )\r
2399                 );\r
2400                 // update comments table (cblog)\r
2401                 $query = 'SELECT '\r
2402                 . '    inumber '\r
2403                 . 'FROM '\r
2404                 .      sql_table('item') . ' '\r
2405                 . 'WHERE '\r
2406                 . '    icat = %d';\r
2407                 $items = sql_query(sprintf($query, $catid));\r
2408                 while ($oItem = sql_fetch_object($items)) {\r
2409                         $query = 'UPDATE '\r
2410                         .      sql_table('comment') . ' '\r
2411                         . 'SET '\r
2412                         . '    cblog = %d' . ' '\r
2413                         . 'WHERE '\r
2414                         . '    citem = %d';\r
2415                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2416                 }\r
2417         \r
2418                 // update items (iblog)\r
2419                 $query = 'UPDATE '\r
2420                 .      sql_table('item') . ' '\r
2421                 . 'SET '\r
2422                 . '    iblog = %d '\r
2423                 . 'WHERE '\r
2424                 . '    icat = %d';\r
2425                 sql_query(sprintf($query, $destblogid, $catid));\r
2426         \r
2427                 // move category\r
2428                 $query = 'UPDATE '\r
2429                 .      sql_table('category') . ' '\r
2430                 . 'SET '\r
2431                 . '    cblog = %d' . ' '\r
2432                 . 'WHERE '\r
2433                 . '    catid = %d';\r
2434                 sql_query(sprintf($query, $destblogid, $catid));\r
2435                 $manager->notify(\r
2436                                 'PostMoveCategory',\r
2437                                 array(\r
2438                                                 'catid'      => &$catid,\r
2439                                                 'sourceblog' => &$blog,\r
2440                                                 'destblog'   => $destblog\r
2441                                 )\r
2442                 );\r
2443                 return;\r
2444         }\r
2445 \r
2446         /**\r
2447          * Admin::action_blogsettingsupdate\r
2448          * Updating blog settings\r
2449          * \r
2450          * @param       Void\r
2451          * @return      Void\r
2452          */\r
2453         static private function action_blogsettingsupdate()\r
2454         {\r
2455                 global $member, $manager;\r
2456                 \r
2457                 $blogid = intRequestVar('blogid');\r
2458                 \r
2459                 $member->blogAdminRights($blogid) or self::disallow();\r
2460                 \r
2461                 $blog =& $manager->getBlog($blogid);\r
2462                 \r
2463                 $notify_address = trim(postVar('notify'));\r
2464                 $shortname              = trim(postVar('shortname'));\r
2465                 $updatefile             = trim(postVar('update'));\r
2466                 \r
2467                 $notifyComment  = intPostVar('notifyComment');\r
2468                 $notifyVote             = intPostVar('notifyVote');\r
2469                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2470                 \r
2471                 if ( $notifyComment == 0 )\r
2472                 {\r
2473                         $notifyComment = 1;\r
2474                 }\r
2475                 if ( $notifyVote == 0 )\r
2476                 {\r
2477                         $notifyVote = 1;\r
2478                 }\r
2479                 if ( $notifyNewItem == 0 )\r
2480                 {\r
2481                         $notifyNewItem = 1;\r
2482                 }\r
2483                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2484                 \r
2485                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2486                 {\r
2487                         self::error(_ERROR_BADNOTIFY);\r
2488                 }\r
2489                 \r
2490                 if ( !isValidShortName($shortname) )\r
2491                 {\r
2492                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2493                 }\r
2494                 \r
2495                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2496                 {\r
2497                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2498                 }\r
2499                 // check if update file is writable\r
2500                 if ( $updatefile && !is_writeable($updatefile) )\r
2501                 {\r
2502                         self::error(_ERROR_UPDATEFILE);\r
2503                 }\r
2504                 \r
2505                 $blog->setName(trim(postVar('name')));\r
2506                 $blog->setShortName($shortname);\r
2507                 $blog->setNotifyAddress($notify_address);\r
2508                 $blog->setNotifyType($notifyType);\r
2509                 $blog->setMaxComments(postVar('maxcomments'));\r
2510                 $blog->setCommentsEnabled(postVar('comments'));\r
2511                 $blog->setTimeOffset(postVar('timeoffset'));\r
2512                 $blog->setUpdateFile($updatefile);\r
2513                 $blog->setURL(trim(postVar('url')));\r
2514                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2515                 $blog->setDescription(trim(postVar('desc')));\r
2516                 $blog->setPublic(postVar('public'));\r
2517                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2518                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2519                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2520                 $blog->setSearchable(intPostVar('searchable'));\r
2521                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2522                 $blog->writeSettings();\r
2523                 \r
2524                 // store plugin options\r
2525                 $aOptions = requestArray('plugoption');\r
2526                 NucleusPlugin::apply_plugin_options($aOptions);\r
2527                 \r
2528                 $data = array(\r
2529                         'context' => 'blog',\r
2530                         'blogid'  => $blogid,\r
2531                         'blog'    => &$blog\r
2532                 );\r
2533                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2534                 \r
2535                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2536                 return;\r
2537         }\r
2538         \r
2539         /**\r
2540          * Admin::action_deleteblog()\r
2541          * \r
2542          * @param       void\r
2543          * @return      void\r
2544          */\r
2545         static private function action_deleteblog()\r
2546         {\r
2547                 global $member, $CONF, $manager;\r
2548                 \r
2549                 $blogid = intRequestVar('blogid');\r
2550                 \r
2551                 $member->blogAdminRights($blogid) or self::disallow();\r
2552                 \r
2553                 // check if blog is default blog\r
2554                 if ( $CONF['DefaultBlog'] == $blogid )\r
2555                 {\r
2556                         self::error(_ERROR_DELDEFBLOG);\r
2557                 }\r
2558                 \r
2559                 $blog =& $manager->getBlog($blogid);\r
2560                 \r
2561                 self::pagehead();\r
2562                 self::$skin->parse('deleteblog');\r
2563                 self::pagefoot();\r
2564                 return;\r
2565         }\r
2566         \r
2567         /**\r
2568          * Admin::action_deleteblogconfirm()\r
2569          * Delete Blog\r
2570          * \r
2571          * @param       Void\r
2572          * @return      Void\r
2573          */\r
2574         static private function action_deleteblogconfirm()\r
2575         {\r
2576                 global $member, $CONF, $manager;\r
2577                 \r
2578                 $blogid = intRequestVar('blogid');\r
2579                 \r
2580                 $data = array('blogid' => $blogid);\r
2581                 $manager->notify('PreDeleteBlog', $data);\r
2582                 \r
2583                 $member->blogAdminRights($blogid) or self::disallow();\r
2584                 \r
2585                 // check if blog is default blog\r
2586                 if ( $CONF['DefaultBlog'] == $blogid )\r
2587                 {\r
2588                         self::error(_ERROR_DELDEFBLOG);\r
2589                 }\r
2590                 \r
2591                 // delete all comments\r
2592                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2593                 DB::execute($query);\r
2594                 \r
2595                 // delete all items\r
2596                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2597                 DB::execute($query);\r
2598                 \r
2599                 // delete all team members\r
2600                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2601                 DB::execute($query);\r
2602                 \r
2603                 // delete all bans\r
2604                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2605                 DB::execute($query);\r
2606                 \r
2607                 // delete all categories\r
2608                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2609                 DB::execute($query);\r
2610                 \r
2611                 // delete all associated plugin options\r
2612                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2613                 \r
2614                 // delete the blog itself\r
2615                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2616                 DB::execute($query);\r
2617                 \r
2618                 $data = array('blogid' => $blogid);\r
2619                 $manager->notify('PostDeleteBlog', $data);\r
2620                 \r
2621                 self::action_overview(_DELETED_BLOG);\r
2622                 return;\r
2623         }\r
2624         \r
2625         /**\r
2626          * Admin::action_memberdelete()\r
2627          * \r
2628          * @param       void\r
2629          * @return      void\r
2630          */\r
2631         static private function action_memberdelete()\r
2632         {\r
2633                 global $member, $manager;\r
2634                 \r
2635                 $memberid = intRequestVar('memberid');\r
2636                 \r
2637                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2638                 \r
2639                 $mem = Member::createFromID($memberid);\r
2640                 \r
2641                 self::pagehead();\r
2642                 self::$skin->parse('memberdelete');\r
2643                 self::pagefoot();\r
2644                 return;\r
2645         }\r
2646         \r
2647         /**\r
2648          * Admin::action_memberdeleteconfirm()\r
2649          * \r
2650          * @param       void\r
2651          * @return      void\r
2652          */\r
2653         static private function action_memberdeleteconfirm()\r
2654         {\r
2655                 global $member;\r
2656                 \r
2657                 $memberid = intRequestVar('memberid');\r
2658                 \r
2659                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2660                 \r
2661                 $error = self::deleteOneMember($memberid);\r
2662                 if ( $error )\r
2663                 {\r
2664                         self::error($error);\r
2665                 }\r
2666                 \r
2667                 if ( $member->isAdmin() )\r
2668                 {\r
2669                         self::action_usermanagement();\r
2670                 }\r
2671                 else\r
2672                 {\r
2673                         self::action_overview(_DELETED_MEMBER);\r
2674                 }\r
2675                 return;\r
2676         }\r
2677         \r
2678         /**\r
2679          * Admin::deleteOneMember()\r
2680          * Delete a member by id\r
2681          * \r
2682          * @static\r
2683          * @params      Integer $memberid       member id\r
2684          * @return      String  null string or error messages\r
2685          */\r
2686         static public function deleteOneMember($memberid)\r
2687         {\r
2688                 global $manager;\r
2689                 \r
2690                 $memberid = intval($memberid);\r
2691                 $mem = Member::createFromID($memberid);\r
2692                 \r
2693                 if ( !$mem->canBeDeleted() )\r
2694                 {\r
2695                         return _ERROR_DELETEMEMBER;\r
2696                 }\r
2697                 \r
2698                 $data = array('member' => &$mem);\r
2699                 $manager->notify('PreDeleteMember', $data);\r
2700                 \r
2701                 /* unlink comments from memberid */\r
2702                 if ( $memberid )\r
2703                 {\r
2704                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2705                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2706                         DB::execute($query);\r
2707                 }\r
2708                 \r
2709                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2710                 DB::execute($query);\r
2711                 \r
2712                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2713                 DB::execute($query);\r
2714                 \r
2715                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2716                 DB::execute($query);\r
2717                 \r
2718                 // delete all associated plugin options\r
2719                 NucleusPlugin::delete_option_values('member', $memberid);\r
2720                 \r
2721                 $data = array('member' => &$mem);\r
2722                 $manager->notify('PostDeleteMember', $data);\r
2723                 \r
2724                 return '';\r
2725         }\r
2726         \r
2727         /**\r
2728          * Admin::action_createnewlog()\r
2729          * \r
2730          * @param       void\r
2731          * @return      void\r
2732          */\r
2733         static private function action_createnewlog()\r
2734         {\r
2735                 global $member, $CONF, $manager;\r
2736                 \r
2737                 // Only Super-Admins can do this\r
2738                 $member->isAdmin() or self::disallow();\r
2739                 \r
2740                 self::pagehead();\r
2741                 self::$skin->parse('createnewlog');\r
2742                 self::pagefoot();\r
2743                 return;\r
2744         }\r
2745         \r
2746         /**\r
2747          * Admin::action_addnewlog()\r
2748          * \r
2749          * @param       void\r
2750          * @return      void\r
2751          */\r
2752         static private function action_addnewlog()\r
2753         {\r
2754                 global $member, $manager, $CONF;\r
2755                 \r
2756                 // Only Super-Admins can do this\r
2757                 $member->isAdmin() or self::disallow();\r
2758                 \r
2759                 $bname                  = trim(postVar('name'));\r
2760                 $bshortname             = trim(postVar('shortname'));\r
2761                 $btimeoffset    = postVar('timeoffset');\r
2762                 $bdesc                  = trim(postVar('desc'));\r
2763                 $bdefskin               = postVar('defskin');\r
2764                 \r
2765                 if ( !isValidShortName($bshortname) )\r
2766                 {\r
2767                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2768                 }\r
2769                 \r
2770                 if ( $manager->existsBlog($bshortname) )\r
2771                 {\r
2772                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2773                 }\r
2774                 \r
2775                 $data = array(\r
2776                         'name'        => &$bname,\r
2777                         'shortname'   => &$bshortname,\r
2778                         'timeoffset'  => &$btimeoffset,\r
2779                         'description' => &$bdesc,\r
2780                         'defaultskin' => &$bdefskin\r
2781                 );\r
2782                 $manager->notify('PreAddBlog', $data);\r
2783                 \r
2784                 // add slashes for sql queries\r
2785                 $bname                  = DB::quoteValue($bname);\r
2786                 $bshortname             = DB::quoteValue($bshortname);\r
2787                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2788                 $bdesc                  = DB::quoteValue($bdesc);\r
2789                 $bdefskin               = DB::quoteValue($bdefskin);\r
2790                 \r
2791                 // create blog\r
2792                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2793                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2794                 DB::execute($query);\r
2795                 \r
2796                 $blogid = DB::getInsertId();\r
2797                 $blog   =& $manager->getBlog($blogid);\r
2798                 \r
2799                 // create new category\r
2800                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2801                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2802                 \r
2803                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2804                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2805                 $catid = DB::getInsertId();\r
2806                 \r
2807                 // set as default category\r
2808                 $blog->setDefaultCategory($catid);\r
2809                 $blog->writeSettings();\r
2810                 \r
2811                 // create team member\r
2812                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2813                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2814                 DB::execute($query);\r
2815                 \r
2816                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2817                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2818                 \r
2819                 $blog->additem(\r
2820                         $blog->getDefaultCategory(),\r
2821                         $itemdeftitle,$itemdefbody,\r
2822                         '',\r
2823                         $blogid,\r
2824                         $member->getID(),\r
2825                         $blog->getCorrectTime(),\r
2826                         0,\r
2827                         0,\r
2828                         0\r
2829                 );\r
2830                 \r
2831                 $data = array('blog' => &$blog);\r
2832                 $manager->notify('PostAddBlog', $data);\r
2833                 \r
2834                 $data = array(\r
2835                         'blog'                  => &$blog,\r
2836                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2837                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2838                         'catid'                 => $catid\r
2839                 );\r
2840                 $manager->notify('PostAddCategory', $data);\r
2841                 \r
2842                 /* TODO: we should consider to use the other way insterad of this */\r
2843                 $_REQUEST['blogid'] = $blogid;\r
2844                 $_REQUEST['catid']  = $catid;\r
2845                 self::pagehead();\r
2846                 self::$skin->parse('addnewlog');\r
2847                 self::pagefoot();\r
2848                 return;\r
2849         }\r
2850         \r
2851         /**\r
2852          * Admin::action_addnewlog2()\r
2853          * \r
2854          * @param       void\r
2855          * @return      void\r
2856          */\r
2857         static private function action_addnewlog2()\r
2858         {\r
2859                 global $member, $manager;\r
2860                 $blogid = intRequestVar('blogid');\r
2861                 \r
2862                 $member->blogAdminRights($blogid) or self::disallow();\r
2863                 \r
2864                 $burl = requestVar('url');\r
2865                 \r
2866                 $blog =& $manager->getBlog($blogid);\r
2867                 $blog->setURL(trim($burl));\r
2868                 $blog->writeSettings();\r
2869                 \r
2870                 self::action_overview(_MSG_NEWBLOG);\r
2871                 return;\r
2872         }\r
2873         \r
2874         /**\r
2875          * Admin::action_skinieoverview()\r
2876          * \r
2877          * @param       void\r
2878          * @return      void\r
2879          */\r
2880         static private function action_skinieoverview()\r
2881         {\r
2882                 global $member, $DIR_LIBS, $manager;\r
2883                 \r
2884                 $member->isAdmin() or self::disallow();\r
2885                 \r
2886                 include_once($DIR_LIBS . 'skinie.php');\r
2887                 \r
2888                 self::pagehead();\r
2889                 self::$skin->parse('skinieoverview');\r
2890                 self::pagefoot();\r
2891                 return;\r
2892         }\r
2893         \r
2894         /**\r
2895          * Admin::action_skinieimport()\r
2896          * \r
2897          * @param       void\r
2898          * @return      void\r
2899          */\r
2900         static private function action_skinieimport()\r
2901         {\r
2902                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2903                 \r
2904                 $member->isAdmin() or self::disallow();\r
2905                 \r
2906                 // load skinie class\r
2907                 include_once($DIR_LIBS . 'skinie.php');\r
2908                 \r
2909                 $skinFileRaw    = postVar('skinfile');\r
2910                 $mode                   = postVar('mode');\r
2911                 \r
2912                 $importer = new SkinImport();\r
2913                 \r
2914                 // get full filename\r
2915                 if ( $mode == 'file' )\r
2916                 {\r
2917                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2918                         \r
2919                         /* TODO: remove this\r
2920                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2921                         if ( !file_exists($skinFile) )\r
2922                         {\r
2923                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2924                         }\r
2925                          */\r
2926                 }\r
2927                 else\r
2928                 {\r
2929                         $skinFile = $skinFileRaw;\r
2930                 }\r
2931                 \r
2932                 // read only metadata\r
2933                 $error = $importer->readFile($skinFile, 1);\r
2934                 \r
2935                 /* TODO: we should consider to use the other way insterad of this */\r
2936                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2937                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2938                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2939                 \r
2940                 // clashes\r
2941                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2942                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2943                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2944                 \r
2945                 /* TODO: we should consider to use the other way insterad of this */\r
2946                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2947                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2948                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2949                 \r
2950                 if ( $error )\r
2951                 {\r
2952                         self::error($error);\r
2953                 }\r
2954                 \r
2955                 self::pagehead();\r
2956                 self::$skin->parse('skinieimport');\r
2957                 self::pagefoot();\r
2958                 return;\r
2959         }\r
2960         \r
2961         /**\r
2962          * Admin::action_skiniedoimport()\r
2963          * \r
2964          * @param       void\r
2965          * @return      void\r
2966          */\r
2967         static private function action_skiniedoimport()\r
2968         {\r
2969                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2970                 \r
2971                 $member->isAdmin() or self::disallow();\r
2972                 \r
2973                 // load skinie class\r
2974                 include_once($DIR_LIBS . 'skinie.php');\r
2975                 \r
2976                 $skinFileRaw    = postVar('skinfile');\r
2977                 $mode                   = postVar('mode');\r
2978                 \r
2979                 $allowOverwrite = intPostVar('overwrite');\r
2980                 \r
2981                 // get full filename\r
2982                 if ( $mode == 'file' )\r
2983                 {\r
2984                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2985                         \r
2986                         /* TODO: remove this\r
2987                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2988                         if ( !file_exists($skinFile) )\r
2989                         {\r
2990                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2991                         }\r
2992                         */\r
2993                 }\r
2994                 else\r
2995                 {\r
2996                         $skinFile = $skinFileRaw;\r
2997                 }\r
2998                 \r
2999                 $importer = new SkinImport();\r
3000                 \r
3001                 $error = $importer->readFile($skinFile);\r
3002                 \r
3003                 if ( $error )\r
3004                 {\r
3005                         self::error($error);\r
3006                 }\r
3007                 \r
3008                 $error = $importer->writeToDatabase($allowOverwrite);\r
3009                 \r
3010                 if ( $error )\r
3011                 {\r
3012                         self::error($error);\r
3013                 }\r
3014                 \r
3015                 /* TODO: we should consider to use the other way insterad of this */\r
3016                 $_REQUEST['skininfo']  = $importer->getInfo();\r
3017                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
3018                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
3019                 \r
3020                 self::pagehead();\r
3021                 self::$skin->parse('skiniedoimport');\r
3022                 self::pagefoot();\r
3023                 return;\r
3024         }\r
3025 \r
3026         /**\r
3027          * Admin::action_skinieexport()\r
3028          * \r
3029          * @param       void\r
3030          * @return      void\r
3031          */\r
3032         static private function action_skinieexport()\r
3033         {\r
3034                 global $member, $DIR_LIBS;\r
3035                 \r
3036                 $member->isAdmin() or self::disallow();\r
3037                 \r
3038                 // load skinie class\r
3039                 include_once($DIR_LIBS . 'skinie.php');\r
3040                 \r
3041                 $aSkins         = requestIntArray('skin');\r
3042                 $aTemplates     = requestIntArray('template');\r
3043                 \r
3044                 if ( !is_array($aTemplates) )\r
3045                 {\r
3046                         $aTemplates = array();\r
3047                 }\r
3048                 if ( !is_array($aSkins) )\r
3049                 {\r
3050                         $aSkins = array();\r
3051                 }\r
3052                 \r
3053                 $skinList               = array_keys($aSkins);\r
3054                 $templateList   = array_keys($aTemplates);\r
3055                 \r
3056                 $info = postVar('info');\r
3057                 \r
3058                 $exporter = new SkinExport();\r
3059                 foreach ( $skinList as $skinId )\r
3060                 {\r
3061                         $exporter->addSkin($skinId);\r
3062                 }\r
3063                 foreach ($templateList as $templateId)\r
3064                 {\r
3065                         $exporter->addTemplate($templateId);\r
3066                 }\r
3067                 $exporter->setInfo($info);\r
3068                 \r
3069                 $exporter->export();\r
3070                 return;\r
3071         }\r
3072         \r
3073         /**\r
3074          * Admin::action_templateoverview()\r
3075          * \r
3076          * @param       void\r
3077          * @return      void\r
3078          */\r
3079         static private function action_templateoverview()\r
3080         {\r
3081                 global $member, $manager;\r
3082                 \r
3083                 $member->isAdmin() or self::disallow();\r
3084                 \r
3085                 self::pagehead();\r
3086                 self::$skin->parse('templateoverview');\r
3087                 self::pagefoot();\r
3088                 return;\r
3089         }\r
3090         \r
3091         /**\r
3092          * Admin::action_templateedit()\r
3093          * \r
3094          * @param       string  $msg    message for pageheader\r
3095          * @return      void\r
3096          */\r
3097         static private function action_templateedit($msg = '')\r
3098         {\r
3099                 global $member, $manager;\r
3100                 if ( $msg )\r
3101                 {\r
3102                         self::$headMess = $msg;\r
3103                 }\r
3104                 \r
3105                 $templateid = intRequestVar('templateid');\r
3106                 \r
3107                 $member->isAdmin() or self::disallow();\r
3108                 \r
3109                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3110                 $extrahead .= '<script type=\"text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . "\");</script>\n";\r
3111                 \r
3112                 self::pagehead($extrahead);\r
3113                 self::$skin->parse('templateedit');\r
3114                 self::pagefoot();\r
3115                 return;\r
3116         }\r
3117         \r
3118         /**\r
3119          * TODO: remove this\r
3120          *\r
3121         static private function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {\r
3122                 static $count = 1;\r
3123                 if (!isset($template[$name])) $template[$name] = '';\r
3124         ?>\r
3125                 </tr><tr>\r
3126                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>\r
3127                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  Entity::hsc($template[$name]); ?></textarea></td>\r
3128         <?php       $count++;\r
3129         }\r
3130         */\r
3131         \r
3132         /**\r
3133          * Admin::action_templateupdate()\r
3134          * \r
3135          * @param       void\r
3136          * @return      void\r
3137          */\r
3138         static private function action_templateupdate()\r
3139         {\r
3140                 global $member,$manager;\r
3141                 \r
3142                 $templateid = intRequestVar('templateid');\r
3143                 \r
3144                 $member->isAdmin() or self::disallow();\r
3145                 \r
3146                 $name = postVar('tname');\r
3147                 $desc = postVar('tdesc');\r
3148                 \r
3149                 if ( !isValidTemplateName($name) )\r
3150                 {\r
3151                         self::error(_ERROR_BADTEMPLATENAME);\r
3152                 }\r
3153                 \r
3154                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3155                 {\r
3156                         self::error(_ERROR_DUPTEMPLATENAME);\r
3157                 }\r
3158                 \r
3159                 // 1. Remove all template parts\r
3160                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3161                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3162                 DB::execute($query);\r
3163                 \r
3164                 // 2. Update description\r
3165                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3166                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3167                 DB::execute($query);\r
3168                 \r
3169                 // 3. Add non-empty template parts\r
3170                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3171                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3172                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3173                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3174                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3175                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3176                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3177                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3178                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3179                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3180                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3181                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3182                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3183                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3184                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3185                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3186                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3187                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3188                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3189                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3190                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3191                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3192                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3193                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3194                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3195                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3196                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3197                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3198                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3199                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3200                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3201                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3202                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3203                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3204                 \r
3205                 $data = array('fields' => array());\r
3206                 $manager->notify('TemplateExtraFields', $data);\r
3207                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3208                 {\r
3209                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3210                         {\r
3211                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3212                         }\r
3213                 }\r
3214                 \r
3215                 // jump back to template edit\r
3216                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3217                 return;\r
3218         }\r
3219         \r
3220         /**\r
3221          * Admin::addToTemplate()\r
3222          * \r
3223          * @param       Integer $id     ID for template\r
3224          * @param       String  $partname       parts name\r
3225          * @param       String  $content        template contents\r
3226          * @return      Integer record index\r
3227          * \r
3228          */\r
3229         static private function addToTemplate($id, $partname, $content)\r
3230         {\r
3231                 // don't add empty parts:\r
3232                 if ( !trim($content) )\r
3233                 {\r
3234                         return -1;\r
3235                 }\r
3236                 \r
3237                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3238                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3239                 if ( DB::execute($query) === FALSE )\r
3240                 {\r
3241                         $err = DB::getError();\r
3242                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3243                 }\r
3244                 return DB::getInsertId();\r
3245         }\r
3246         \r
3247         /**\r
3248          * Admin::action_templatedelete()\r
3249          * \r
3250          * @param       void\r
3251          * @return      void\r
3252          */\r
3253         static private function action_templatedelete()\r
3254         {\r
3255                 global $member, $manager;\r
3256                 \r
3257                 $member->isAdmin() or self::disallow();\r
3258                 \r
3259                 $templateid = intRequestVar('templateid');\r
3260                 // TODO: check if template can be deleted\r
3261                 \r
3262                 self::pagehead();\r
3263                 self::$skin->parse('templatedelete');\r
3264                 self::pagefoot();\r
3265                 return;\r
3266         }\r
3267         \r
3268         /**\r
3269          * Admin::action_templatedeleteconfirm()\r
3270          * \r
3271          * @param       void\r
3272          * @return      void\r
3273          */\r
3274         static private function action_templatedeleteconfirm()\r
3275         {\r
3276                 global $member, $manager;\r
3277                 \r
3278                 $templateid = intRequestVar('templateid');\r
3279                 \r
3280                 $member->isAdmin() or self::disallow();\r
3281                 \r
3282                 $data = array('templateid' => $templateid);\r
3283                 $manager->notify('PreDeleteTemplate', $data);\r
3284                 \r
3285                 // 1. delete description\r
3286                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3287                 \r
3288                 // 2. delete parts\r
3289                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3290                 \r
3291                 \r
3292                 $data = array('templateid' => $templateid);\r
3293                 $manager->notify('PostDeleteTemplate', $data);\r
3294                 \r
3295                 self::action_templateoverview();\r
3296                 return;\r
3297         }\r
3298         \r
3299         /**\r
3300          * Admin::action_templatenew()\r
3301          * \r
3302          * @param       void\r
3303          * @return      void\r
3304          */\r
3305         static private function action_templatenew()\r
3306         {\r
3307                 global $member;\r
3308                 \r
3309                 $member->isAdmin() or self::disallow();\r
3310                 \r
3311                 $name = postVar('name');\r
3312                 $desc = postVar('desc');\r
3313                 \r
3314                 if ( !isValidTemplateName($name) )\r
3315                 {\r
3316                         self::error(_ERROR_BADTEMPLATENAME);\r
3317                 }\r
3318                 \r
3319                 if ( Template::exists($name) )\r
3320                 {\r
3321                         self::error(_ERROR_DUPTEMPLATENAME);\r
3322                 }\r
3323                 \r
3324                 $newTemplateId = Template::createNew($name, $desc);\r
3325                 \r
3326                 self::action_templateoverview();\r
3327                 return;\r
3328         }\r
3329         \r
3330         /**\r
3331          * Admin::action_templateclone()\r
3332          * \r
3333          * @param       void\r
3334          * @return      void\r
3335          */\r
3336         static private function action_templateclone()\r
3337         {\r
3338                 global $member;\r
3339                 \r
3340                 $templateid = intRequestVar('templateid');\r
3341                 \r
3342                 $member->isAdmin() or self::disallow();\r
3343                 \r
3344                 // 1. read old template\r
3345                 $name = Template::getNameFromId($templateid);\r
3346                 $desc = Template::getDesc($templateid);\r
3347                 \r
3348                 // 2. create desc thing\r
3349                 $name = "cloned" . $name;\r
3350                 \r
3351                 // if a template with that name already exists:\r
3352                 if ( Template::exists($name) )\r
3353                 {\r
3354                         $i = 1;\r
3355                         while (Template::exists($name . $i))\r
3356                         {\r
3357                                 $i++;\r
3358                         }\r
3359                         $name .= $i;\r
3360                 }\r
3361                 \r
3362                 $newid = Template::createNew($name, $desc);\r
3363                 \r
3364                 // 3. create clone\r
3365                 // go through parts of old template and add them to the new one\r
3366                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3367                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3368                 \r
3369                 $res = DB::getResult($query);\r
3370                 foreach ( $res as $row)\r
3371                 {\r
3372                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3373                 }\r
3374                 \r
3375                 self::action_templateoverview();\r
3376                 return;\r
3377         }\r
3378         \r
3379         /**\r
3380          * Admin::action_admintemplateoverview()\r
3381          * \r
3382          * @param       void\r
3383          * @return      void\r
3384          */\r
3385         static private function action_admintemplateoverview()\r
3386         {\r
3387                 global $member, $manager;\r
3388                 $member->isAdmin() or self::disallow();\r
3389                 self::pagehead();\r
3390                 self::$skin->parse('admntemplateoverview');\r
3391                 self::pagefoot();\r
3392                 return;\r
3393         }\r
3394         \r
3395         /**\r
3396          * Admin::action_admintemplateedit()\r
3397          * \r
3398          * @param       string  $msg    message for pageheader\r
3399          * @return      void\r
3400          */\r
3401         static private function action_admintemplateedit($msg = '')\r
3402         {\r
3403                 global $member, $manager;\r
3404                 if ( $msg )\r
3405                 {\r
3406                         self::$headMess = $msg;\r
3407                 }\r
3408                 $member->isAdmin() or self::disallow();\r
3409                 $extrahead  = "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3410                 $extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3411                 self::pagehead($extrahead);\r
3412                 self::$skin->parse('admintemplateedit');\r
3413                 self::pagefoot();\r
3414                 return;\r
3415         }\r
3416         \r
3417         /**\r
3418          * Admin::action_admintemplateupdate()\r
3419          * \r
3420          * @param       void\r
3421          * @return      void\r
3422          */\r
3423         static private function action_admintemplateupdate()\r
3424         {\r
3425                 global $member, $manager;\r
3426                 $templateid = intRequestVar('templateid');\r
3427                 $member->isAdmin() or self::disallow();\r
3428                 $name = postVar('tname');\r
3429                 $desc = postVar('tdesc');\r
3430                 \r
3431                 if ( !isValidTemplateName($name) )\r
3432                 {\r
3433                         self::error(_ERROR_BADTEMPLATENAME);\r
3434                 }\r
3435                 \r
3436                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3437                 {\r
3438                         self::error(_ERROR_DUPTEMPLATENAME);\r
3439                 }\r
3440                 \r
3441                 // 1. Remove all template parts\r
3442                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3443                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3444                 DB::execute($query);\r
3445                 \r
3446                 // 2. Update description\r
3447                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3448                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3449                 DB::execute($query);\r
3450                 \r
3451                 // 3. Add non-empty template parts\r
3452                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_HEAD',                                 postVar('ADMINSKINTYPELIST_HEAD'));\r
3453                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_BODY',                                 postVar('ADMINSKINTYPELIST_BODY'));\r
3454                 self::addToAdminTemplate($templateid, 'ADMINSKINTYPELIST_FOOT',                                 postVar('ADMINSKINTYPELIST_FOOT'));\r
3455                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3456                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3457                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3458                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3459                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3460                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3461                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3462                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3463                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3464                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3465                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3466                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3468                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3469                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3470                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3471                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3472                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3473                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3474                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3475                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3476                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3477                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3478                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3479                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3480                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3481                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3482                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3483                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3484                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3485                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3486                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3487                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3488                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3489                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3490                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3491                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3492                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3493                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3494                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3495                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3496                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3497                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3498                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3499                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3500                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3501                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3502                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3503                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3504                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3505                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3506                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3507                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3508                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3509                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3510                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3511                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3512                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3513                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3514                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3515                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3516                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3517                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3518                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3519                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3520                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3521                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3522                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3523                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3524                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3525                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3526                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3527                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3528                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3529                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3530                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3531                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3532                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3533                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3534                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3535                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3536                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3537                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3538                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3539                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3540                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3541                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3542                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3543                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3544                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3545                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3546                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3547                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3548                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3549                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3550                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3551                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3552                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3553                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3554                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3555                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3556                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3557                 \r
3558                 $data = array('fields' => array());\r
3559                 $manager->notify('TemplateExtraFields', $data);\r
3560                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3561                 {\r
3562                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3563                         {\r
3564                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3565                         }\r
3566                 }\r
3567                 \r
3568                 // jump back to template edit\r
3569                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3570                 return;\r
3571         }\r
3572         \r
3573         /**\r
3574          * Admin::addToAdminTemplate()\r
3575          * \r
3576          * @param       integer $id                     ID for template\r
3577          * @param       string  $partname       name of part for template\r
3578          * @param       void    $contents       content for part of template\r
3579          * @return      integer ID for newly inserted Template\r
3580          */\r
3581         static private function addToAdminTemplate($id, $partname, $content)\r
3582         {\r
3583                 // don't add empty parts:\r
3584                 if ( !trim($content) )\r
3585                 {\r
3586                         return -1;\r
3587                 }\r
3588                 \r
3589                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3590                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3591                 if ( DB::execute($query) === FALSE )\r
3592                 {\r
3593                         $err = DB::getError();\r
3594                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3595                 }\r
3596                 return DB::getInsertId();\r
3597         }\r
3598         \r
3599         /**\r
3600          * Admin::action_admintemplatedelete()\r
3601          * \r
3602          * @param       void\r
3603          * @return      void\r
3604          */\r
3605         static private function action_admintemplatedelete()\r
3606         {\r
3607                 global $member, $manager;\r
3608                 $member->isAdmin() or self::disallow();\r
3609                 \r
3610                 // TODO: check if template can be deleted\r
3611                 self::pagehead();\r
3612                 self::$skin->parse('admintemplatedelete');\r
3613                 self::pagefoot();\r
3614                 return;\r
3615         }\r
3616         \r
3617         /**\r
3618          * Admin::action_admintemplatedeleteconfirm()\r
3619          * \r
3620          * @param       void\r
3621          * @return      void\r
3622          */\r
3623         static private function action_admintemplatedeleteconfirm()\r
3624         {\r
3625                 global $member, $manager;\r
3626                 \r
3627                 $templateid = intRequestVar('templateid');\r
3628                 $member->isAdmin() or self::disallow();\r
3629                 \r
3630                 $data = array('templateid' => $templateid);\r
3631                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3632                 \r
3633                 // 1. delete description\r
3634                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3635                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3636                 DB::execute($query);\r
3637                 \r
3638                 // 2. delete parts\r
3639                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3640                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3641                 DB::execute($query);\r
3642                 \r
3643                 $data = array('templateid' => $templateid);\r
3644                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3645                 \r
3646                 self::action_admintemplateoverview();\r
3647                 return;\r
3648         }\r
3649         \r
3650         /**\r
3651          * Admin::action_admintemplatenew()\r
3652          * \r
3653          * @param       void\r
3654          * @return      void\r
3655          */\r
3656         static private function action_admintemplatenew()\r
3657         {\r
3658                 global $member;\r
3659                 $member->isAdmin() or self::disallow();\r
3660                 $name = postVar('name');\r
3661                 $desc = postVar('desc');\r
3662                 \r
3663                 if ( !isValidTemplateName($name) )\r
3664                 {\r
3665                         self::error(_ERROR_BADTEMPLATENAME);\r
3666                 }\r
3667                 else if ( !preg_match('#^admin/#', $name) )\r
3668                 {\r
3669                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3670                 }\r
3671                 else if ( Template::exists($name) )\r
3672                 {\r
3673                         self::error(_ERROR_DUPTEMPLATENAME);\r
3674                 }\r
3675                 \r
3676                 $newTemplateId = Template::createNew($name, $desc);\r
3677                 self::action_admintemplateoverview();\r
3678                 return;\r
3679         }\r
3680         \r
3681         /**\r
3682          * Admin::action_admintemplateclone()\r
3683          * \r
3684          * @param       void\r
3685          * @return      void\r
3686          */\r
3687         static private function action_admintemplateclone()\r
3688         {\r
3689                 global $member;\r
3690                 $templateid = intRequestVar('templateid');\r
3691                 $member->isAdmin() or self::disallow();\r
3692                 \r
3693                 // 1. read old template\r
3694                 $name = Template::getNameFromId($templateid);\r
3695                 $desc = Template::getDesc($templateid);\r
3696                 \r
3697                 // 2. create desc thing\r
3698                 $name = $name . "cloned";\r
3699                 \r
3700                 // if a template with that name already exists:\r
3701                 if ( Template::exists($name) )\r
3702                 {\r
3703                         $i = 1;\r
3704                         while ( Template::exists($name . $i) )\r
3705                         {\r
3706                                 $i++;\r
3707                         }\r
3708                         $name .= $i;\r
3709                 }\r
3710                 \r
3711                 $newid = Template::createNew($name, $desc);\r
3712                 \r
3713                 // 3. create clone\r
3714                 // go through parts of old template and add them to the new one\r
3715                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3716                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3717                 \r
3718                 $res = DB::getResult($query);\r
3719                 foreach ( $res as $row )\r
3720                 {\r
3721                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3722                 }\r
3723                 \r
3724                 self::action_admintemplateoverview();\r
3725                 return;\r
3726         }\r
3727 \r
3728         /**\r
3729          * Admin::action_skinoverview()\r
3730          * \r
3731          * @param       void\r
3732          * @return      void\r
3733          */\r
3734         static private function action_skinoverview()\r
3735         {\r
3736                 global $member, $manager;\r
3737                 \r
3738                 $member->isAdmin() or self::disallow();\r
3739                 \r
3740                 self::pagehead();\r
3741                 self::$skin->parse('skinoverview');\r
3742                 self::pagefoot();\r
3743                 return;\r
3744         }\r
3745         \r
3746         /**\r
3747          * Admin::action_skinnew()\r
3748          * \r
3749          * @param       void\r
3750          * @return      void\r
3751          */\r
3752         static private function action_skinnew()\r
3753         {\r
3754                 global $member;\r
3755                 \r
3756                 $member->isAdmin() or self::disallow();\r
3757                 \r
3758                 $name = trim(postVar('name'));\r
3759                 $desc = trim(postVar('desc'));\r
3760                 \r
3761                 if ( !isValidSkinName($name) )\r
3762                 {\r
3763                         self::error(_ERROR_BADSKINNAME);\r
3764                 }\r
3765                 \r
3766                 if ( SKIN::exists($name) )\r
3767                 {\r
3768                         self::error(_ERROR_DUPSKINNAME);\r
3769                 }\r
3770                 \r
3771                 $newId = SKIN::createNew($name, $desc);\r
3772                 \r
3773                 self::action_skinoverview();\r
3774                 return;\r
3775         }\r
3776         \r
3777         /**\r
3778          * Admin::action_skinedit()\r
3779          * \r
3780          * @param       void\r
3781          * @return      void\r
3782          */\r
3783         static private function action_skinedit()\r
3784         {\r
3785                 global $member, $manager;\r
3786                 \r
3787                 $member->isAdmin() or self::disallow();\r
3788                 \r
3789                 self::pagehead();\r
3790                 self::$skin->parse('skinedit');\r
3791                 self::pagefoot();\r
3792                 return;\r
3793         }\r
3794         \r
3795         /**\r
3796          * Admin::action_skineditgeneral()\r
3797          * \r
3798          * @param       void\r
3799          * @return      void\r
3800          */\r
3801         static private function action_skineditgeneral()\r
3802         {\r
3803                 global $member;\r
3804                 \r
3805                 $skinid = intRequestVar('skinid');\r
3806                 \r
3807                 $member->isAdmin() or self::disallow();\r
3808                 \r
3809                 $name           = postVar('name');\r
3810                 $desc           = postVar('desc');\r
3811                 $type           = postVar('type');\r
3812                 $inc_mode       = postVar('inc_mode');\r
3813                 $inc_prefix     = postVar('inc_prefix');\r
3814                 \r
3815                 $skin = new Skin($skinid);\r
3816                 \r
3817                 // 1. Some checks\r
3818                 if ( !isValidSkinName($name) )\r
3819                 {\r
3820                         self::error(_ERROR_BADSKINNAME);\r
3821                 }\r
3822                 \r
3823                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3824                 {\r
3825                         self::error(_ERROR_DUPSKINNAME);\r
3826                 }\r
3827                 \r
3828                 if ( !$type )\r
3829                 {\r
3830                         $type = 'text/html';\r
3831                 }\r
3832                 if ( !$inc_mode )\r
3833                 {\r
3834                         $inc_mode = 'normal';\r
3835                 }\r
3836                 \r
3837                 // 2. Update description\r
3838                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3839                 \r
3840                 self::action_skinedit();\r
3841                 return;\r
3842         }\r
3843         \r
3844         static private function action_skinedittype($msg = '')\r
3845         {\r
3846                 global $member, $manager;\r
3847                 \r
3848                 $member->isAdmin() or self::disallow();\r
3849                 \r
3850                 if ( $msg )\r
3851                 {\r
3852                         self::$headMess = $msg;\r
3853                 }\r
3854                 \r
3855                 $skinid = intRequestVar('skinid');\r
3856                 $type   = requestVar('type');\r
3857                 $type   = trim($type);\r
3858                 $type   = strtolower($type);\r
3859                 \r
3860                 if ( !isValidShortName($type) )\r
3861                 {\r
3862                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3863                 }\r
3864                 \r
3865                 self::pagehead();\r
3866                 self::$skin->parse('skinedittype');\r
3867                 self::pagefoot();\r
3868                 return;\r
3869         }\r
3870         \r
3871         /**\r
3872          * Admin::action_skinupdate()\r
3873          * \r
3874          * @param       void\r
3875          * @return      void\r
3876          */\r
3877         static private function action_skinupdate()\r
3878         {\r
3879                 global $member;\r
3880                 \r
3881                 $skinid = intRequestVar('skinid');\r
3882                 $content = trim(postVar('content'));\r
3883                 $type = postVar('type');\r
3884                 \r
3885                 $member->isAdmin() or self::disallow();\r
3886                 \r
3887                 $skin = new SKIN($skinid);\r
3888                 $skin->update($type, $content);\r
3889                 \r
3890                 self::action_skinedittype(_SKIN_UPDATED);\r
3891                 return;\r
3892         }\r
3893         \r
3894         /**\r
3895          * Admin::action_skindelete()\r
3896          * \r
3897          * @param       void\r
3898          * @return      void\r
3899          */\r
3900         static private function action_skindelete()\r
3901         {\r
3902                 global $member, $manager, $CONF;\r
3903                 \r
3904                 $skinid = intRequestVar('skinid');\r
3905                 \r
3906                 $member->isAdmin() or self::disallow();\r
3907                 \r
3908                 // don't allow default skin to be deleted\r
3909                 if ( $skinid == $CONF['BaseSkin'] )\r
3910                 {\r
3911                         self::error(_ERROR_DEFAULTSKIN);\r
3912                 }\r
3913                 \r
3914                 // don't allow deletion of default skins for blogs\r
3915                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3916                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3917                 \r
3918                 $name = DB::getValue($query);\r
3919                 if ( $name )\r
3920                 {\r
3921                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3922                 }\r
3923                 \r
3924                 self::pagehead();\r
3925                 self::$skin->parse('skindelete');\r
3926                 self::pagefoot();\r
3927                 return;\r
3928         }\r
3929         \r
3930         /**\r
3931          * Admin::action_skindeleteconfirm()\r
3932          * \r
3933          * @param       void\r
3934          * @return      void\r
3935          */\r
3936         static private function action_skindeleteconfirm()\r
3937         {\r
3938                 global $member, $CONF, $manager;\r
3939                 \r
3940                 $skinid = intRequestVar('skinid');\r
3941                 \r
3942                 $member->isAdmin() or self::disallow();\r
3943                 \r
3944                 // don't allow default skin to be deleted\r
3945                 if ( $skinid == $CONF['BaseSkin'] )\r
3946                 {\r
3947                         self::error(_ERROR_DEFAULTSKIN);\r
3948                 }\r
3949                 \r
3950                 // don't allow deletion of default skins for blogs\r
3951                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3952                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3953                 \r
3954                 $name = DB::getValue($query);\r
3955                 if ( $name )\r
3956                                 {\r
3957                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3958                 }\r
3959                 \r
3960                 $data = array('skinid' => $skinid);\r
3961                 $manager->notify('PreDeleteSkin', $data);\r
3962                 \r
3963                 // 1. delete description\r
3964                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3965                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3966                 DB::execute($query);\r
3967                 \r
3968                 // 2. delete parts\r
3969                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3970                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3971                 DB::execute($query);\r
3972                 \r
3973                 $data = array('skinid' => $skinid);\r
3974                 $manager->notify('PostDeleteSkin', $data);\r
3975                 \r
3976                 self::action_skinoverview();\r
3977                 return;\r
3978         }\r
3979         \r
3980         /**\r
3981          * Admin::action_skinremovetype()\r
3982          * \r
3983          * @param       void\r
3984          * @return      void\r
3985          */\r
3986         static private function action_skinremovetype()\r
3987         {\r
3988                 global $member, $manager, $CONF;\r
3989                 \r
3990                 $member->isAdmin() or self::disallow();\r
3991                 \r
3992                 $skinid = intRequestVar('skinid');\r
3993                 $skintype = requestVar('type');\r
3994                 \r
3995                 if ( !isValidShortName($skintype) )\r
3996                 {\r
3997                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3998                 }\r
3999                 \r
4000                 // don't allow default skinparts to be deleted\r
4001                 /* TODO: this array should be retrieved from Action class */\r
4002                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
4003                 {\r
4004                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4005                 }\r
4006                 \r
4007                 self::pagehead();\r
4008                 self::$skin->parse('skinremovetype');\r
4009                 self::pagefoot();\r
4010                 return;\r
4011         }\r
4012         \r
4013         /**\r
4014          * Admin::action_skinremovetypeconfirm()\r
4015          * \r
4016          * @param       void\r
4017          * @return      void\r
4018          */\r
4019         static private function action_skinremovetypeconfirm()\r
4020         {\r
4021                 global $member, $CONF, $manager;\r
4022                 \r
4023                 $member->isAdmin() or self::disallow();\r
4024                 \r
4025                 $skinid = intRequestVar('skinid');\r
4026                 $skintype = requestVar('type');\r
4027                 \r
4028                 if ( !isValidShortName($skintype) )\r
4029                 {\r
4030                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4031                 }\r
4032                 \r
4033                 // don't allow default skinparts to be deleted\r
4034                 /* TODO: this array should be retrieved from Action class */\r
4035                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
4036                 {\r
4037                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4038                 }\r
4039                 \r
4040                 $data = array(\r
4041                         'skinid'   => $skinid,\r
4042                         'skintype' => $skintype\r
4043                 );\r
4044                 $manager->notify('PreDeleteSkinPart', $data);\r
4045                 \r
4046                 // delete part\r
4047                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype='%s';";\r
4048                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, (integer) $skintype);\r
4049                 DB::execute($query);\r
4050                 \r
4051                 $data = array(\r
4052                         'skinid'   => $skinid,\r
4053                         'skintype' => $skintype\r
4054                 );\r
4055                 $manager->notify('PostDeleteSkinPart', $data);\r
4056                 \r
4057                 self::action_skinedit();\r
4058                 return;\r
4059         }\r
4060 \r
4061         /**\r
4062          * Admin::action_skinclone()\r
4063          * \r
4064          * @param       void\r
4065          * @return      void\r
4066          */\r
4067         static private function action_skinclone()\r
4068         {\r
4069                 global $member;\r
4070                 \r
4071                 $member->isAdmin() or self::disallow();\r
4072                 \r
4073                 $skinid = intRequestVar('skinid');\r
4074                 \r
4075                 // 1. read skin to clone\r
4076                 $skin = new Skin($skinid);\r
4077                 \r
4078                 $name = "{$skin->getName()}_clone";\r
4079                 \r
4080                 // if a skin with that name already exists:\r
4081                 if ( Skin::exists($name) )\r
4082                 {\r
4083                         $i = 1;\r
4084                         while ( Skin::exists($name . $i) )\r
4085                         {\r
4086                                 $i++;\r
4087                         }\r
4088                         $name .= $i;\r
4089                 }\r
4090                 \r
4091                 // 2. create skin desc\r
4092                 $newid = Skin::createNew(\r
4093                         $name,\r
4094                         $skin->getDescription(),\r
4095                         $skin->getContentType(),\r
4096                         $skin->getIncludeMode(),\r
4097                         $skin->getIncludePrefix()\r
4098                 );\r
4099                 \r
4100                 // 3. clone\r
4101                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4102                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4103                 \r
4104                 $res = DB::getResult($query);\r
4105                 foreach ( $res as $row )\r
4106                 {\r
4107                         self::skinclonetype($skin, $newid, $row['stype']);\r
4108                 }\r
4109                 \r
4110                 self::action_skinoverview();\r
4111                 return;\r
4112         }\r
4113         \r
4114         /**\r
4115          * Admin::skinclonetype()\r
4116          * \r
4117          * @param       String  $skin   Skin object\r
4118          * @param       Integer $newid  ID for this clone\r
4119          * @param       String  $type   type of skin\r
4120          * @return      Void\r
4121          */\r
4122         static private function skinclonetype($skin, $newid, $type)\r
4123         {\r
4124                 $newid = intval($newid);\r
4125                 $content = $skin->getContentFromDB($type);\r
4126                 \r
4127                 if ( $content )\r
4128                 {\r
4129                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4130                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4131                         DB::execute($query);\r
4132                 }\r
4133                 return;\r
4134         }\r
4135         \r
4136         /**\r
4137          * Admin::action_adminskinoverview()\r
4138          * \r
4139          * @param       void\r
4140          * @return      void\r
4141          */\r
4142         static private function action_adminskinoverview()\r
4143         {\r
4144                 global $member, $manager;\r
4145                 \r
4146                 $member->isAdmin() or self::disallow();\r
4147                 \r
4148                 self::pagehead();\r
4149                 self::$skin->parse('adminskinoverview');\r
4150                 self::pagefoot();\r
4151                 return;\r
4152         }\r
4153         \r
4154         /**\r
4155          * Admin::action_adminskinnew()\r
4156          * \r
4157          * @param       void\r
4158          * @return      void\r
4159          */\r
4160         static private function action_adminskinnew()\r
4161         {\r
4162                 global $member;\r
4163                 $member->isAdmin() or self::disallow();\r
4164                 $name = trim(postVar('name'));\r
4165                 $desc = trim(postVar('desc'));\r
4166                 \r
4167                 if ( !isValidSkinName($name) )\r
4168                 {\r
4169                         self::error(_ERROR_BADSKINNAME);\r
4170                 }\r
4171                 else if ( !preg_match('#^admin/#', $name) )\r
4172                 {\r
4173                         self::error(_ERROR_BADADMINSKINNAME);\r
4174                 }\r
4175                 else if ( Skin::exists($name) )\r
4176                 {\r
4177                         self::error(_ERROR_DUPSKINNAME);\r
4178                 }\r
4179                 /* TODO: $newId is not reused... */\r
4180                 $newId = Skin::createNew($name, $desc);\r
4181                 self::action_adminskinoverview();\r
4182                 return;\r
4183         }\r
4184         \r
4185         /**\r
4186          * Admin::action_adminskinedit()\r
4187          * \r
4188          * @param       void\r
4189          * @return      void\r
4190          */\r
4191         static private function action_adminskinedit()\r
4192         {\r
4193                 global $member, $manager;\r
4194                 \r
4195                 $member->isAdmin() or self::disallow();\r
4196                 self::pagehead();\r
4197                 self::$skin->parse('adminskinedit');\r
4198                 self::pagefoot();\r
4199                 return;\r
4200         }\r
4201         \r
4202         /**\r
4203          * Admin::action_adminskineditgeneral()\r
4204          * \r
4205          * @param       void\r
4206          * @return      void\r
4207          */\r
4208         static private function action_adminskineditgeneral()\r
4209         {\r
4210                 global $member;\r
4211                 \r
4212                 $skinid = intRequestVar('skinid');\r
4213                 \r
4214                 $member->isAdmin() or self::disallow();\r
4215                 \r
4216                 $name           = postVar('name');\r
4217                 $desc           = postVar('desc');\r
4218                 $type           = postVar('type');\r
4219                 $inc_mode       = postVar('inc_mode');\r
4220                 $inc_prefix     = postVar('inc_prefix');\r
4221                 \r
4222                 $skin = new Skin($skinid, 'AdminActions', 'AdminSkin');\r
4223                 \r
4224                 // 1. Some checks\r
4225                 if ( !isValidSkinName($name) )\r
4226                 {\r
4227                         self::error(_ERROR_BADSKINNAME);\r
4228                 }\r
4229                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4230                 {\r
4231                         self::error(_ERROR_DUPSKINNAME);\r
4232                 }\r
4233                 if ( !$type )\r
4234                 {\r
4235                         $type = 'text/html';\r
4236                 }\r
4237                 if ( !$inc_mode )\r
4238                 {\r
4239                         $inc_mode = 'normal';\r
4240                 }\r
4241                 // 2. Update description\r
4242                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4243                 self::action_adminskinedit();\r
4244                 return;\r
4245         }\r
4246         \r
4247         /**\r
4248          * Admin::action_adminskinedittype()\r
4249          * \r
4250          * @param       string  $msg    message for pageheader\r
4251          * @return      void\r
4252          */\r
4253         static private function action_adminskinedittype($msg = '')\r
4254         {\r
4255                 global $member, $manager;\r
4256                 \r
4257                 $member->isAdmin() or self::disallow();\r
4258                 \r
4259                 if ( $msg )\r
4260                 {\r
4261                         self::$headMess = $msg;\r
4262                 }\r
4263                 $type = requestVar('type');\r
4264                 $type = trim($type);\r
4265                 $type = strtolower($type);\r
4266                 \r
4267                 if ( !isValidShortName($type) )\r
4268                 {\r
4269                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4270                 }\r
4271                 \r
4272                 self::pagehead();\r
4273                 self::$skin->parse('adminskinedittype');\r
4274                 self::pagefoot();\r
4275                 return;\r
4276         }\r
4277         \r
4278         /**\r
4279          * Admin::action_adminskinupdate()\r
4280          * \r
4281          * @param       void\r
4282          * @return      void\r
4283          */\r
4284         static private function action_adminskinupdate()\r
4285         {\r
4286                 global $member;\r
4287                 $skinid         = intRequestVar('skinid');\r
4288                 $content        = trim(postVar('content'));\r
4289                 $type           = postVar('type');\r
4290                 \r
4291                 $member->isAdmin() or self::disallow();\r
4292                 \r
4293                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4294                 $skin->update($type, $content);\r
4295                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4296                 return;\r
4297         }\r
4298         \r
4299         /**\r
4300          * Admin::action_adminskindelete()\r
4301          * \r
4302          * @param       void\r
4303          * @return      void\r
4304          */\r
4305         static private function action_adminskindelete()\r
4306         {\r
4307                 global $member, $manager, $CONF;\r
4308                 $member->isAdmin() or self::disallow();\r
4309                 \r
4310                 /* TODO: needless variable $skinid... */\r
4311                 $skinid = intRequestVar('skinid');\r
4312                 self::pagehead();\r
4313                 self::$skin->parse('adminskindelete');\r
4314                 self::pagefoot();\r
4315                 return;\r
4316         }\r
4317 \r
4318         /**\r
4319          * Admin::action_adminskindeleteconfirm()\r
4320          * \r
4321          * @param       void\r
4322          * @return      void\r
4323          */\r
4324         static private function action_adminskindeleteconfirm()\r
4325         {\r
4326                 global $member, $CONF, $manager;\r
4327                 \r
4328                 $member->isAdmin() or self::disallow();\r
4329                 $skinid = intRequestVar('skinid');\r
4330                 \r
4331                 // don't allow default skin to be deleted\r
4332                 if ( $skinid == $CONF['AdminSkin'] )\r
4333                 {\r
4334                         self::error(_ERROR_DEFAULTSKIN);\r
4335                 }\r
4336                 \r
4337                 /*\r
4338                  * TODO: NOT Implemented\r
4339                  *  don't allow deletion of default skins for members\r
4340                 $memberDefaults =  $member->getAdminSkin();\r
4341                 foreach ( $memberDefaults as $memID => $adminskin )\r
4342                 {\r
4343                         if ( $skinid == $adminskin )\r
4344                         {\r
4345                                 $mem = MEMBER::createFromID($memID);\r
4346                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4347                         }\r
4348                 }\r
4349                 */\r
4350                 \r
4351                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4352                 \r
4353                 // 1. delete description\r
4354                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4355                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4356                 DB::execute($query);\r
4357                 \r
4358                 // 2. delete parts\r
4359                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4360                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4361                 \r
4362                 DB::execute($query);\r
4363                 \r
4364                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4365                 self::action_adminskinoverview();\r
4366                 return;\r
4367         }\r
4368         \r
4369         /**\r
4370          * Admin::action_adminskinremovetype()\r
4371          * \r
4372          * @param       void\r
4373          * @return      void\r
4374          */\r
4375         static private function action_adminskinremovetype()\r
4376         {\r
4377                 global $member, $manager, $CONF;\r
4378 \r
4379                 $member->isAdmin() or self::disallow();\r
4380                 \r
4381                 $skinid         = intRequestVar('skinid');\r
4382                 $skintype       = requestVar('type');\r
4383                 \r
4384                 if ( !isValidShortName($skintype) )\r
4385                 {\r
4386                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4387                 }\r
4388                 \r
4389                 self::pagehead();\r
4390                 self::$skin->parse('adminskinremovetype');\r
4391                 self::pagefoot();\r
4392                 return;\r
4393         }\r
4394         \r
4395         /**\r
4396          * Admin::action_adminskinremovetypeconfirm()\r
4397          * \r
4398          * @param       void\r
4399          * @return      void\r
4400          */\r
4401         static private function action_adminskinremovetypeconfirm()\r
4402         {\r
4403                 global $member, $CONF, $manager;\r
4404                 \r
4405                 $member->isAdmin() or self::disallow();\r
4406                 \r
4407                 $skinid         = intRequestVar('skinid');\r
4408                 $skintype       = requestVar('type');\r
4409                 \r
4410                 if ( !isValidShortName($skintype) )\r
4411                 {\r
4412                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4413                 }\r
4414                 \r
4415                 $data =array(\r
4416                         'skinid'        => $skinid,\r
4417                         'skintype'      => $skintype\r
4418                 );\r
4419                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4420                 \r
4421                 // delete part\r
4422                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype ="%s"';\r
4423                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, $skintype);\r
4424                 DB::execute($query);\r
4425                 \r
4426                 $data = array(\r
4427                         'skinid'        => $skinid,\r
4428                         'skintype'      => $skintype\r
4429                 );\r
4430                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4431                 \r
4432                 self::action_adminskinedit();\r
4433                 return;\r
4434         }\r
4435 \r
4436         /**\r
4437          * Admin::action_adminskinclone()\r
4438          * \r
4439          * @param       void\r
4440          * @return      void\r
4441          */\r
4442         static private function action_adminskinclone()\r
4443         {\r
4444                 global $member;\r
4445                 \r
4446                 $member->isAdmin() or self::disallow();\r
4447                 \r
4448                 $skinid = intRequestVar('skinid');\r
4449                 \r
4450                 // 1. read skin to clone\r
4451                 $skin = new Skin($skinid, 'Admin', 'AdminSkin');\r
4452                 $name = "{$skin->getName()}_clone";\r
4453                 \r
4454                 // if a skin with that name already exists:\r
4455                 if ( Skin::exists($name) )\r
4456                 {\r
4457                         $i = 1;\r
4458                         while ( Skin::exists($name . $i) )\r
4459                         {\r
4460                                 $i++;\r
4461                         }\r
4462                         $name .= $i;\r
4463                 }\r
4464                 \r
4465                 // 2. create skin desc\r
4466                 $newid = Skin::createNew(\r
4467                         $name,\r
4468                         $skin->getDescription(),\r
4469                         $skin->getContentType(),\r
4470                         $skin->getIncludeMode(),\r
4471                         $skin->getIncludePrefix()\r
4472                 );\r
4473                 \r
4474                 // 3. clone\r
4475                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4476                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4477                 \r
4478                 $res = DB::getResult($query);\r
4479                 foreach ( $res as $row )\r
4480                 {\r
4481                         self::skinclonetype($skin, $newid, $row['stype']);\r
4482                 }\r
4483                 self::action_adminskinoverview();\r
4484                 return;\r
4485         }\r
4486         \r
4487         /**\r
4488          * Admin::adminskinclonetype()\r
4489          * \r
4490          * @param       string  $skin   an instance of Skin class\r
4491          * @param       integer $newid  ID for new skin\r
4492          * @param       string  $type   skin type\r
4493          * @return      void\r
4494          */\r
4495         static private function adminskinclonetype($skin, $newid, $type)\r
4496         {\r
4497                 $content = $skin->getContentFromDB($type);\r
4498                 \r
4499                 if ( $content )\r
4500                 {\r
4501                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4502                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4503                         DB::execute($query);\r
4504                 }\r
4505                 return;\r
4506         }\r
4507         \r
4508         /**\r
4509          * Admin::action_adminskinieoverview()\r
4510          * \r
4511          * @param       void\r
4512          * @return      void\r
4513          */\r
4514         static private function action_adminskinieoverview()\r
4515         {\r
4516                 global $member, $DIR_LIBS, $manager;\r
4517                 \r
4518                 $member->isAdmin() or self::disallow();\r
4519                 \r
4520                 // load skinie class\r
4521                 include_once($DIR_LIBS . 'skinie.php');\r
4522                 \r
4523                 self::pagehead();\r
4524                 self::$skin->parse('adminskinieoverview');\r
4525                 self::pagefoot();\r
4526                 return;\r
4527         }\r
4528 \r
4529         /**\r
4530          * Admin::action_adminskinieimport()\r
4531          * \r
4532          * @param       void\r
4533          * @return      void\r
4534          */\r
4535         static private function action_adminskinieimport()\r
4536         {\r
4537                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4538                 \r
4539                 $member->isAdmin() or self::disallow();\r
4540                 \r
4541                 // load skinie class\r
4542                 include_once($DIR_LIBS . 'skinie.php');\r
4543                 \r
4544                 $skinFileRaw    = postVar('skinfile');\r
4545                 $mode                   = postVar('mode');\r
4546                 \r
4547                 $importer = new SKINIMPORT();\r
4548                 \r
4549                 // get full filename\r
4550                 if ( $mode == 'file' )\r
4551                 {\r
4552                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4553                         \r
4554                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4555                         if ( !file_exists($skinFile) )\r
4556                         {\r
4557                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4558                         }\r
4559                 }\r
4560                 else\r
4561                 {\r
4562                         $skinFile = $skinFileRaw;\r
4563                 }\r
4564                 \r
4565                 // read only metadata\r
4566                 $error = $importer->readFile($skinFile, 1);\r
4567                 if ( $error )\r
4568                 {\r
4569                         self::error($error);\r
4570                 }\r
4571                 \r
4572                 /* TODO: we should consider to use the other way instead of this */\r
4573                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4574                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4575                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4576                 \r
4577                 // clashes\r
4578                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4579                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4580                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4581                 /* TODO: we should consider to use the other way instead of this */\r
4582                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4583                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4584                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4585                 \r
4586                 self::pagehead();\r
4587                 self::$skin->parse('adminskinieimport');\r
4588                 self::pagefoot();\r
4589                 return;\r
4590         }\r
4591         \r
4592         /**\r
4593          * Admin::action_adminskiniedoimport()\r
4594          * \r
4595          * @param       void\r
4596          * @return      void\r
4597          */\r
4598         static private function action_adminskiniedoimport()\r
4599         {\r
4600                 global $DIR_LIBS, $DIR_SKINS, $member;\r
4601                 \r
4602                 $member->isAdmin() or self::disallow();\r
4603                 \r
4604                 // load skinie class\r
4605                 include_once($DIR_LIBS . 'skinie.php');\r
4606                 \r
4607                 $skinFileRaw    = postVar('skinfile');\r
4608                 $mode                   = postVar('mode');\r
4609                 $allowOverwrite = intPostVar('overwrite');\r
4610                 \r
4611                 // get full filename\r
4612                 if ( $mode == 'file' )\r
4613                 {\r
4614                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4615                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4616                         if ( !file_exists($skinFile) )\r
4617                         {\r
4618                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4619                         }\r
4620                 }\r
4621                 else\r
4622                 {\r
4623                         $skinFile = $skinFileRaw;\r
4624                 }\r
4625                 \r
4626                 $importer = new SKINIMPORT();\r
4627                 \r
4628                 $error = $importer->readFile($skinFile);\r
4629                 if ( $error )\r
4630                 {\r
4631                         self::error($error);\r
4632                 }\r
4633                 \r
4634                 $error = $importer->writeToDatabase($allowOverwrite);\r
4635                 if ( $error )\r
4636                 {\r
4637                         self::error($error);\r
4638                 }\r
4639                 \r
4640                 /* TODO: we should consider to use the other way instead of this */\r
4641                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4642                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4643                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4644                 \r
4645                 self::pagehead();\r
4646                 self::$skin->parse('adminskiniedoimport');\r
4647                 self::pagefoot();\r
4648                 return;\r
4649         }\r
4650 \r
4651         /**\r
4652          * Admin::action_adminskinieexport()\r
4653          * \r
4654          * @param       void\r
4655          * @return      void\r
4656          */\r
4657         static private function action_adminskinieexport()\r
4658         {\r
4659                 global $member, $DIR_PLUGINS;\r
4660                 \r
4661                 $member->isAdmin() or self::disallow();\r
4662                 \r
4663                 // load skinie class\r
4664                 $aSkins = requestIntArray('skin');\r
4665                 if (!is_array($aSkins)) {\r
4666                         $aSkins = array();\r
4667                 }\r
4668                 $skinList = array_keys($aSkins);\r
4669                 \r
4670                 $aTemplates = requestIntArray('template');\r
4671                 if (!is_array($aTemplates))\r
4672                 {\r
4673                         $aTemplates = array();\r
4674                 }\r
4675                 $templateList = array_keys($aTemplates);\r
4676                 \r
4677                 $info = postVar('info');\r
4678                 \r
4679                 include_libs('skinie.php');\r
4680                 $exporter = new SkinExport();\r
4681                 foreach ( $skinList as $skinId )\r
4682                 {\r
4683                         $exporter->addSkin($skinId);\r
4684                 }\r
4685                 foreach ( $templateList as $templateId )\r
4686                 {\r
4687                         $exporter->addTemplate($templateId);\r
4688                 }\r
4689                 $exporter->setInfo($info);\r
4690                 $exporter->export();\r
4691                 return;\r
4692         }\r
4693         \r
4694         /**\r
4695          * Admin::action_settingsedit()\r
4696          * \r
4697          * @param       Void\r
4698          * @return      Void\r
4699          */\r
4700         static private function action_settingsedit()\r
4701         {\r
4702                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4703                 \r
4704                 $member->isAdmin() or self::disallow();\r
4705                 \r
4706                 self::pagehead();\r
4707                 self::$skin->parse('settingsedit');\r
4708                 self::pagefoot();\r
4709                 return;\r
4710         }\r
4711         \r
4712         /**\r
4713          * Admin::action_settingsupdate()\r
4714          * Update $CONFIG and redirect\r
4715          * \r
4716          * @param       void\r
4717          * @return      void\r
4718          */\r
4719         static private function action_settingsupdate()\r
4720         {\r
4721                 global $member, $CONF;\r
4722                 \r
4723                 $member->isAdmin() or self::disallow();\r
4724                 \r
4725                 // check if email address for admin is valid\r
4726                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4727                 {\r
4728                         self::error(_ERROR_BADMAILADDRESS);\r
4729                 }\r
4730                 \r
4731                 // save settings\r
4732                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4733                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4734                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4735                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4736                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4737                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4738                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4739                 self::updateConfig('Locale',                    postVar('Locale'));\r
4740                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4741                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4742                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4743                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4744                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4745                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4746                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4747                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4748                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4749                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4750                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4751                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4752                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4753                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4754                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4755                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4756                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4757                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4758                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4759                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4760                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4761                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4762                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4763                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4764                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4765                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4766                 \r
4767                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4768                 // note that when changing cookie settings, this redirect might cause the user\r
4769                 // to have to log in again.\r
4770                 getConfig();\r
4771                 redirect($CONF['AdminURL'] . '?action=manage');\r
4772                 return;\r
4773         }\r
4774         \r
4775         /**\r
4776          * Admin::action_systemoverview()\r
4777          * Output system overview\r
4778          * \r
4779          * @param       void\r
4780          * @return      void\r
4781          */\r
4782         static private function action_systemoverview()\r
4783         {\r
4784                 self::pagehead();\r
4785                 self::$skin->parse('systemoverview');\r
4786                 self::pagefoot();\r
4787                 return;\r
4788         }\r
4789         \r
4790         /**\r
4791          * Admin::updateConfig()\r
4792          * \r
4793          * @param       string  $name   \r
4794          * @param       string  $val    \r
4795          * @return      integer return the ID in which the latest query posted\r
4796          */\r
4797         static private function updateConfig($name, $val)\r
4798         {\r
4799                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4800                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4801                 if ( DB::execute($query) === FALSE )\r
4802                 {\r
4803                         $err = DB::getError();\r
4804                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4805                 }\r
4806                 return DB::getInsertId();\r
4807         }\r
4808         \r
4809         /**\r
4810          * Admin::error()\r
4811          * Error message\r
4812          * \r
4813          * @param       string  $msg    message that will be shown\r
4814          * @return      void\r
4815          */\r
4816         static public function error($msg)\r
4817         {\r
4818                 self::$headMess = $msg;\r
4819                 self::pagehead();\r
4820                 self::$skin->parse('adminerrorpage');\r
4821                 self::pagefoot();\r
4822                 return;\r
4823         }\r
4824         \r
4825         /**\r
4826          * Admin::disallow()\r
4827          * add error log and show error page \r
4828          * \r
4829          * @param       void\r
4830          * @return      void\r
4831          */\r
4832         static public function disallow()\r
4833         {\r
4834                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4835                 self::error(_ERROR_DISALLOWED);\r
4836                 return;\r
4837         }\r
4838         \r
4839         /**\r
4840          * Admin::PluninAdminPagehead()\r
4841          * Output pluginadmin page head\r
4842          *\r
4843          * @param       string  $extrahead\r
4844          * @return      void\r
4845          */\r
4846         static public function PluninAdminPagehead($extrahead = '')\r
4847         {\r
4848                 self::pagehead();\r
4849                 return;\r
4850         }\r
4851         \r
4852         /**\r
4853          * Admin::PluninAdminPagefoot()\r
4854          * Output pluginadmin page foot\r
4855          *\r
4856          * @param       void\r
4857          * @return      void\r
4858          */\r
4859         static public function PluninAdminPagefoot()\r
4860         {\r
4861                 self::pagefoot();\r
4862                 return;\r
4863         }\r
4864         \r
4865         /**\r
4866          * Admin::pagehead()\r
4867          * Output admin page head\r
4868          * \r
4869          * @param       string  PluninAdminPagehead\r
4870          * @return      void\r
4871          */\r
4872         static private function pagehead($extrahead = '')\r
4873         {\r
4874                 global $member, $nucleus, $CONF, $manager;\r
4875 \r
4876                 if ( self::existsSkinContents('pagehead') )\r
4877                 {\r
4878                         if ( isset($extrahead) && !empty($extrahead) )\r
4879                         {\r
4880                                 self::$extrahead = $extrahead;\r
4881                         }\r
4882                         self::$skin->parse('pagehead');\r
4883                 }\r
4884                 else\r
4885                 {\r
4886                         $data = array(\r
4887                                 'extrahead'     => &$extrahead,\r
4888                                 'action'        => self::$action\r
4889                         );\r
4890                         \r
4891                         $manager->notify('AdminPrePageHead', $data);\r
4892                         \r
4893                         $baseUrl = Entity::hsc($CONF['SkinsURL']);\r
4894                         \r
4895                         /*\r
4896                          * TODO: obsoleted\r
4897                         if ( !array_key_exists('AdminCSS', $CONF) )\r
4898                         {\r
4899                                 DB::execute("INSERT INTO " . sql_table('config') . " VALUES ('AdminCSS', 'original')");\r
4900                                 $CONF['AdminCSS'] = 'original';\r
4901                         }\r
4902                         */\r
4903                         \r
4904                         /* HTTP 1.1 application for no caching */\r
4905                         header("Cache-Control: no-cache, must-revalidate");\r
4906                         header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");\r
4907                         \r
4908                         $root_element = 'html';\r
4909                         $charset = i18n::get_current_charset();\r
4910                         $locale = preg_replace('#_#', '-', i18n::get_current_locale());\r
4911                         $xml_version_info = self::$xml_version_info;\r
4912                         $formal_public_identifier = self::$formal_public_identifier;\r
4913                         $system_identifier = self::$system_identifier;\r
4914                         $xhtml_namespace = self::$xhtml_namespace;\r
4915                         \r
4916                         echo "<?xml version=\"{$xml_version_info}\" encoding=\"{$charset}\" ?>\n";\r
4917                         echo "<!DOCTYPE {$root_element} PUBLIC \"{$formal_public_identifier}\" \"{$system_identifier}\">\n";\r
4918                         echo "<{$root_element} xmlns=\"{$xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";\r
4919                         echo "<head>\n";\r
4920                         echo '<title>' . Entity::hsc($CONF['SiteName']) . " - Admin</title>\n";\r
4921                         /*\r
4922                          * TODO: obsoleted\r
4923                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/admin_{$CONF["AdminCSS"]}.css\" />\n";\r
4924                         */\r
4925                         echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}admin/defaultadmin/styles/addedit.css\" />\n";\r
4926                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascripts/edit.js\"></script>\n";\r
4927                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascripts/admin.js\"></script>\n";\r
4928                         echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascripts/compatibility.js\"></script>\n";\r
4929                         echo "{$extrahead}\n";\r
4930                         echo "</head>\n\n";\r
4931                         echo "<body>\n";\r
4932                         echo "<div id=\"adminwrapper\">\n";\r
4933                         echo "<div class=\"header\">\n";\r
4934                         echo '<h1>' . Entity::hsc($CONF['SiteName']) . "</h1>\n";\r
4935                         echo "</div>\n";\r
4936                         echo "<div id=\"container\">\n";\r
4937                         echo "<div id=\"content\">\n";\r
4938                         echo "<div class=\"loginname\">\n";\r
4939                         if ( $member->isLoggedIn() )\r
4940                         {\r
4941                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";\r
4942                                 echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";\r
4943                         }\r
4944                         else\r
4945                         {\r
4946                                 echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";\r
4947                         }\r
4948                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";\r
4949                         echo '(';\r
4950                         \r
4951                         if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )\r
4952                         {\r
4953                                 $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';\r
4954                         }\r
4955                         else\r
4956                         {\r
4957                                 $codenamestring = '';\r
4958                         }\r
4959                         \r
4960                         if ( $member->isLoggedIn() && $member->isAdmin() )\r
4961                         {\r
4962                                 $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());\r
4963                                 echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';\r
4964                                 \r
4965                                 $newestVersion = getLatestVersion();\r
4966                                 $newestCompare = str_replace('/', '.', $newestVersion);\r
4967                                 $currentVersion = str_replace(array('/','v'), array('.',''), $nucleus['version']);\r
4968                                 \r
4969                                 if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )\r
4970                                 {\r
4971                                         echo "<br />\n";\r
4972                                         echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';\r
4973                                         echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;\r
4974                                         echo "</a>";\r
4975                                 }\r
4976                         }\r
4977                         else\r
4978                         {\r
4979                                 echo "Nucleus CMS {$nucleus['version']}{$codenamestring}";\r
4980                         }\r
4981                         echo ')';\r
4982                         echo '</div>';\r
4983                 }\r
4984                 return;\r
4985         }\r
4986         \r
4987         /**\r
4988          * Admin::pagefoot()\r
4989          * Output admin page foot include quickmenu\r
4990          * \r
4991          * @param       void\r
4992          * @return      void\r
4993          */\r
4994         static private function pagefoot()\r
4995         {\r
4996                 global $action, $member, $manager;\r
4997                 \r
4998                 if ( self::existsSkinContents('pagefoot') )\r
4999                 {\r
5000                         self::$skin->parse('pagefoot');\r
5001                         exit;\r
5002                 }\r
5003                 else\r
5004                 {\r
5005                         $data = array(\r
5006                                 'action' => self::$action\r
5007                         );\r
5008                         \r
5009                         $manager->notify('AdminPrePageFoot', $data);\r
5010                         \r
5011                         if ( $member->isLoggedIn() && ($action != 'showlogin') )\r
5012                         {\r
5013                                 echo '<h2>' . _LOGOUT . "</h2>\n";\r
5014                                 echo "<ul>\n";\r
5015                                 echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";\r
5016                                 echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";\r
5017                                 echo "</ul>\n";\r
5018                         }\r
5019                         \r
5020                         echo "<div class=\"foot\">\n";\r
5021                         echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;\r
5022                         echo '-';\r
5023                         echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";\r
5024                         echo "</div>\n";\r
5025                         \r
5026                         echo "<div id=\"quickmenu\">\n";\r
5027                         \r
5028                         if ( ($action != 'showlogin') && ($member->isLoggedIn()) )\r
5029                         {\r
5030                                 echo "<ul>\n";\r
5031                                 echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";\r
5032                                 echo "</ul>\n";\r
5033                                 \r
5034                                 echo '<h2>' . _QMENU_ADD . "</h2>\n";\r
5035                                 echo "<form method=\"get\" action=\"index.php\">\n";\r
5036                                 echo "<p>\n";\r
5037                                 echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";\r
5038                                 \r
5039                                 $showAll = requestVar('showall');\r
5040                                 \r
5041                                 if ( ($member->isAdmin()) && ($showAll == 'yes') )\r
5042                                 {\r
5043                                         // Super-Admins have access to all blogs! (no add item support though)\r
5044                                         $query = "SELECT bnumber as value, bname as text FROM %s ORDER BY bname;";\r
5045                                         $query = sprintf($query, sql_table('blog'));\r
5046                                 }\r
5047                                 else\r
5048                                 {\r
5049                                         $query = "SELECT bnumber as value, bname as text FROM %s, %s WHERE tblog=bnumber and tmember=%d ORDER BY bname;";\r
5050                                         $query = sprintf($query, sql_table('blog'), sql_table('team'), (integer) $member->getID());\r
5051                                 }\r
5052                                 $template['name']               = 'blogid';\r
5053                                 $template['tabindex']   = 15000;\r
5054                                 $template['extra']              = _QMENU_ADD_SELECT;\r
5055                                 $template['selected']   = -1;\r
5056                                 $template['shorten']    = 10;\r
5057                                 $template['shortenel']  = '';\r
5058                                 $template['javascript'] = 'onchange="return form.submit()"';\r
5059                                 showlist($query, 'select', $template);\r
5060                                 \r
5061                                 echo "</p>\n";\r
5062                                 echo "</form>\n";\r
5063                                 \r
5064                                 echo "<h2>{$member->getDisplayName()}</h2>\n";\r
5065                                 echo "<ul>\n";\r
5066                                 echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";\r
5067                                 echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";\r
5068                                 echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";\r
5069                                 echo "</ul>\n";\r
5070                                 \r
5071                                 if ( $member->isAdmin() )\r
5072                                 {\r
5073                                         echo '<h2>' . _QMENU_MANAGE . "</h2>\n";\r
5074                                         echo "<ul>\n";\r
5075                                         echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";\r
5076                                         echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";\r
5077                                         echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";\r
5078                                         echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";\r
5079                                         echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";\r
5080                                         echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";\r
5081                                         echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";\r
5082                                         echo "</ul>\n";\r
5083                                         \r
5084                                         echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";\r
5085                                         echo "<ul>\n";\r
5086                                         echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";\r
5087                                         echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";\r
5088                                         echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";\r
5089                                         echo "</ul>\n";\r
5090                                 }\r
5091                                 \r
5092                                 $data = array('options' => array());\r
5093                                 \r
5094                                 $manager->notify('QuickMenu', $data);\r
5095                                 \r
5096                                 if ( count($data['options']) > 0 )\r
5097                                 {\r
5098                                         echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";\r
5099                                         echo "<ul>\n";\r
5100                                         foreach ( $data['options'] as $option )\r
5101                                         {\r
5102                                                 echo '<li><a href="' . Entity::hsc($option['url']) . '" title="' . Entity::hsc($option['tooltip']) . '">' . Entity::hsc($option['title']) . "</a></li>\n";\r
5103                                         }\r
5104                                         echo "</ul>\n";\r
5105                                 }\r
5106                         }\r
5107                         else if ( ($action == 'activate') || ($action == 'activatesetpwd') )\r
5108                         {\r
5109                         \r
5110                                 echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;\r
5111                         }\r
5112                         else\r
5113                         {\r
5114                                 echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;\r
5115                         }\r
5116                         \r
5117                         echo "<!-- quickmenu -->\n";\r
5118                         echo "</div>\n";\r
5119                         \r
5120                         echo "<!-- content -->\n";\r
5121                         echo "</div>\n";\r
5122                         \r
5123                         echo "<!-- container -->\n";\r
5124                         echo "</div>\n";\r
5125                         \r
5126                         echo "<!-- adminwrapper -->\n";\r
5127                         echo "</div>\n";\r
5128                         \r
5129                         echo "</body>\n";\r
5130                         echo "</html>\n";\r
5131                 }\r
5132                 return;\r
5133         }\r
5134         \r
5135         /**\r
5136          * Admin::action_bookmarklet()\r
5137          * \r
5138          * @param       void\r
5139          * @return      void\r
5140          */\r
5141         static private function action_bookmarklet()\r
5142         {\r
5143                 global $member, $manager;\r
5144                 \r
5145                 $blogid = intRequestVar('blogid');\r
5146                 $member->teamRights($blogid) or self::disallow();\r
5147                 \r
5148                 self::pagehead();\r
5149                 self::$skin->parse('bookmarklet');\r
5150                 self::pagefoot();\r
5151                 return;\r
5152         }\r
5153         \r
5154         /**\r
5155          * Admin::action_actionlog()\r
5156          * \r
5157          * @param       void\r
5158          * @return      void\r
5159          */\r
5160         static private function action_actionlog()\r
5161         {\r
5162                 global $member, $manager;\r
5163                 \r
5164                 $member->isAdmin() or self::disallow();\r
5165                 \r
5166                 self::pagehead();\r
5167                 self::$skin->parse('actionlog');\r
5168                 self::pagefoot();\r
5169                 return;\r
5170         }\r
5171         \r
5172         /**\r
5173          * Admin::action_banlist()\r
5174          * \r
5175          * @param       void\r
5176          * @return      void\r
5177          */\r
5178         static private function action_banlist()\r
5179         {\r
5180                 global $member, $manager;\r
5181                 \r
5182                 $blogid = intRequestVar('blogid');\r
5183                 $member->blogAdminRights($blogid) or self::disallow();\r
5184                 \r
5185                 self::pagehead();\r
5186                 self::$skin->parse('banlist');\r
5187                 self::pagefoot();\r
5188                 return;\r
5189         }\r
5190         \r
5191         /**\r
5192          * Admin::action_banlistdelete()\r
5193          * \r
5194          * @param       void\r
5195          * @return      void\r
5196          */\r
5197         static private function action_banlistdelete()\r
5198         {\r
5199                 global $member, $manager;\r
5200                 \r
5201                 $blogid = intRequestVar('blogid');\r
5202                 $member->blogAdminRights($blogid) or self::disallow();\r
5203                 \r
5204                 self::pagehead();\r
5205                 self::$skin->parse('banlistdelete');\r
5206                 self::pagefoot();\r
5207                 return;\r
5208         }\r
5209         \r
5210         /**\r
5211          * Admin::action_banlistdeleteconfirm()\r
5212          * \r
5213          * @param       void\r
5214          * @return      void\r
5215          */\r
5216         static private function action_banlistdeleteconfirm()\r
5217         {\r
5218                 global $member, $manager;\r
5219                 \r
5220                 $blogid         = intPostVar('blogid');\r
5221                 $allblogs       = postVar('allblogs');\r
5222                 $iprange        = postVar('iprange');\r
5223                 \r
5224                 $member->blogAdminRights($blogid) or self::disallow();\r
5225                 \r
5226                 $deleted = array();\r
5227                 \r
5228                 if ( !$allblogs )\r
5229                 {\r
5230                         if ( Ban::removeBan($blogid, $iprange) )\r
5231                         {\r
5232                                 $deleted[] = $blogid;\r
5233                         }\r
5234                 }\r
5235                 else\r
5236                 {\r
5237                         // get blogs fot which member has admin rights\r
5238                         $adminblogs = $member->getAdminBlogs();\r
5239                         foreach ($adminblogs as $blogje)\r
5240                         {\r
5241                                 if ( Ban::removeBan($blogje, $iprange) )\r
5242                                 {\r
5243                                         $deleted[] = $blogje;\r
5244                                 }\r
5245                         }\r
5246                 }\r
5247                 \r
5248                 if ( sizeof($deleted) == 0 )\r
5249                 {\r
5250                         self::error(_ERROR_DELETEBAN);\r
5251                 }\r
5252                 \r
5253                 /* TODO: we should use other ways */\r
5254                 $_REQUEST['delblogs'] = $deleted;\r
5255                 \r
5256                 self::pagehead();\r
5257                 self::$skin->parse('banlistdeleteconfirm');\r
5258                 self::pagefoot();\r
5259                 return;\r
5260         }\r
5261         \r
5262         /**\r
5263          * Admin::action_banlistnewfromitem()\r
5264          * \r
5265          * @param       void\r
5266          * @return      void\r
5267          */\r
5268         static private function action_banlistnewfromitem()\r
5269         {\r
5270                 self::action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));\r
5271                 return;\r
5272         }\r
5273         \r
5274         /**\r
5275          * Admin::action_banlistnew()\r
5276          * \r
5277          * @param       integer $blogid ID for weblog\r
5278          * @return      void\r
5279          */\r
5280         static private function action_banlistnew($blogid = '')\r
5281         {\r
5282                 global $member, $manager;\r
5283                 \r
5284                 if ( $blogid == '' )\r
5285                 {\r
5286                         $blogid = intRequestVar('blogid');\r
5287                 }\r
5288                 \r
5289                 $ip = requestVar('ip');\r
5290                 \r
5291                 $member->blogAdminRights($blogid) or self::disallow();\r
5292                 \r
5293                 /* TODO: we should consider to use the other way instead of this */\r
5294                 $_REQUEST['blogid'] = $blogid;          \r
5295                 \r
5296                 self::pagehead();\r
5297                 self::$skin->parse('banlistnew');\r
5298                 self::pagefoot();\r
5299                 \r
5300                 return;\r
5301         }\r
5302 \r
5303         /**\r
5304          * Admin::action_banlistadd()\r
5305          * \r
5306          * @param       void\r
5307          * @return      void\r
5308          */\r
5309         static private function action_banlistadd()\r
5310         {\r
5311                 global $member;\r
5312                 \r
5313                 $blogid         = intPostVar('blogid');\r
5314                 $allblogs       = postVar('allblogs');\r
5315                 $iprange        = postVar('iprange');\r
5316                 \r
5317                 if ( $iprange == "custom" )\r
5318                 {\r
5319                         $iprange = postVar('customiprange');\r
5320                 }\r
5321                 $reason   = postVar('reason');\r
5322                 \r
5323                 $member->blogAdminRights($blogid) or self::disallow();\r
5324                 \r
5325                 // TODO: check IP range validity\r
5326                 \r
5327                 if ( !$allblogs )\r
5328                 {\r
5329                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
5330                         {\r
5331                                 self::error(_ERROR_ADDBAN);\r
5332                         }\r
5333                 }\r
5334                 else\r
5335                 {\r
5336                         // get blogs fot which member has admin rights\r
5337                         $adminblogs = $member->getAdminBlogs();\r
5338                         $failed = 0;\r
5339                         foreach ($adminblogs as $blogje)\r
5340                         {\r
5341                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
5342                                 {\r
5343                                         $failed = 1;\r
5344                                 }\r
5345                         }\r
5346                         if ( $failed )\r
5347                         {\r
5348                                 self::error(_ERROR_ADDBAN);\r
5349                         }\r
5350                 }\r
5351                 self::action_banlist();\r
5352                 return;\r
5353         }\r
5354         \r
5355         /**\r
5356          * Admin::action_clearactionlog()\r
5357          * \r
5358          * @param       void\r
5359          * @return      void\r
5360          */\r
5361         static private function action_clearactionlog()\r
5362         {\r
5363                 global $member;\r
5364                 \r
5365                 $member->isAdmin() or self::disallow();\r
5366                 \r
5367                 ActionLog::clear();\r
5368                 \r
5369                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
5370                 return;\r
5371         }\r
5372         \r
5373         /**\r
5374          * Admin::action_backupoverview()\r
5375          * \r
5376          * @param       void\r
5377          * @return      void\r
5378          */\r
5379         static private function action_backupoverview()\r
5380         {\r
5381                 global $member, $manager;\r
5382                 \r
5383                 $member->isAdmin() or self::disallow();\r
5384                 \r
5385                 self::pagehead();\r
5386                 self::$skin->parse('backupoverview');\r
5387                 self::pagefoot();\r
5388                 return;\r
5389         }\r
5390 \r
5391         /**\r
5392          * Admin::action_backupcreate()\r
5393          * create file for backup\r
5394          * \r
5395          * @param               void\r
5396          * @return      void\r
5397          * \r
5398          */\r
5399         static private function action_backupcreate()\r
5400         {\r
5401                 global $member, $DIR_LIBS;\r
5402                 \r
5403                 $member->isAdmin() or self::disallow();\r
5404                 \r
5405                 // use compression ?\r
5406                 $useGzip = (integer) postVar('gzip');\r
5407                 \r
5408                 include($DIR_LIBS . 'backup.php');\r
5409                 \r
5410                 // try to extend time limit\r
5411                 // (creating/restoring dumps might take a while)\r
5412                 @set_time_limit(1200);\r
5413                 \r
5414                 Backup::do_backup($useGzip);\r
5415                 exit;\r
5416         }\r
5417         \r
5418         /**\r
5419          * Admin::action_backuprestore()\r
5420          * restoring from uploaded file\r
5421          * \r
5422          * @param               void\r
5423          * @return      void\r
5424          */\r
5425         static private function action_backuprestore()\r
5426         {\r
5427                 global $member, $DIR_LIBS;\r
5428                 \r
5429                 $member->isAdmin() or self::disallow();\r
5430                 \r
5431                 if ( intPostVar('letsgo') != 1 )\r
5432                 {\r
5433                         self::error(_ERROR_BACKUP_NOTSURE);\r
5434                 }\r
5435                 \r
5436                 include($DIR_LIBS . 'backup.php');\r
5437                 \r
5438                 // try to extend time limit\r
5439                 // (creating/restoring dumps might take a while)\r
5440                 @set_time_limit(1200);\r
5441                 \r
5442                 $message = Backup::do_restore();\r
5443                 if ( $message != '' )\r
5444                 {\r
5445                         self::error($message);\r
5446                 }\r
5447                 self::pagehead();\r
5448                 self::$skin->parse('backuprestore');\r
5449                 self::pagefoot();\r
5450                 return;\r
5451         }\r
5452         \r
5453         /**\r
5454          * Admin::action_pluginlist()\r
5455          * output the list of installed plugins\r
5456          * \r
5457          * @param       void\r
5458          * @return      void\r
5459          * \r
5460          */\r
5461         static private function action_pluginlist()\r
5462         {\r
5463                 global $DIR_PLUGINS, $member, $manager;\r
5464                 \r
5465                 // check if allowed\r
5466                 $member->isAdmin() or self::disallow();\r
5467                 \r
5468                 self::pagehead();\r
5469                 self::$skin->parse('pluginlist');\r
5470                 self::pagefoot();\r
5471                 return;\r
5472         }\r
5473         \r
5474         /**\r
5475          * Admin::action_pluginhelp()\r
5476          * \r
5477          * @param       void\r
5478          * @return      void\r
5479          */\r
5480         static private function action_pluginhelp()\r
5481         {\r
5482                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5483                 \r
5484                 // check if allowed\r
5485                 $member->isAdmin() or self::disallow();\r
5486                 \r
5487                 $plugid = intGetVar('plugid');\r
5488                 \r
5489                 if ( !$manager->pidInstalled($plugid) )\r
5490                 {\r
5491                         self::error(_ERROR_NOSUCHPLUGIN);\r
5492                 }\r
5493                 \r
5494                 self::pagehead();\r
5495                 self::$skin->parse('pluginhelp');\r
5496                 self::pagefoot();\r
5497                 return;\r
5498         }\r
5499         \r
5500         /**\r
5501          * Admin::action_pluginadd()\r
5502          * \r
5503          * @param       Void\r
5504          * @return      Void\r
5505          * \r
5506          */\r
5507         static private function action_pluginadd()\r
5508         {\r
5509                 global $member, $manager, $DIR_PLUGINS;\r
5510                 \r
5511                 // check if allowed\r
5512                 $member->isAdmin() or self::disallow();\r
5513                 \r
5514                 $name = postVar('filename');\r
5515                 \r
5516                 if ( $manager->pluginInstalled($name) )\r
5517                 {\r
5518                         self::error(_ERROR_DUPPLUGIN);\r
5519                 }\r
5520                 \r
5521                 if ( !checkPlugin($name) )\r
5522                 {\r
5523                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5524                 }\r
5525                 \r
5526                 // get number of currently installed plugins\r
5527                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5528                 $numCurrent = $res->rowCount();\r
5529                 \r
5530                 // plugin will be added as last one in the list\r
5531                 $newOrder = $numCurrent + 1;\r
5532                 \r
5533                 $data = array('file' => &$name);\r
5534                 $manager->notify('PreAddPlugin', $data);\r
5535                 \r
5536                 // do this before calling getPlugin (in case the plugin id is used there)\r
5537                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5538                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5539                 DB::execute($query);\r
5540                 $iPid = DB::getInsertId();\r
5541                 \r
5542                 $manager->clearCachedInfo('installedPlugins');\r
5543                 \r
5544                 // Load the plugin for condition checking and instalation\r
5545                 $plugin =& $manager->getPlugin($name);\r
5546                 \r
5547                 // check if it got loaded (could have failed)\r
5548                 if ( !$plugin )\r
5549                 {\r
5550                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5551                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5552                         \r
5553                         DB::execute($query);\r
5554                         \r
5555                         $manager->clearCachedInfo('installedPlugins');\r
5556                         self::error(_ERROR_PLUGIN_LOAD);\r
5557                 }\r
5558                 \r
5559                 // check if plugin needs a newer Nucleus version\r
5560                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5561                 {\r
5562                         // uninstall plugin again...\r
5563                         self::deleteOnePlugin($plugin->getID());\r
5564                         \r
5565                         // ...and show error\r
5566                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5567                 }\r
5568                 \r
5569                 // check if plugin needs a newer Nucleus version\r
5570                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5571                 {\r
5572                         // uninstall plugin again...\r
5573                         self::deleteOnePlugin($plugin->getID());\r
5574                         \r
5575                         // ...and show error\r
5576                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5577                 }\r
5578                 \r
5579                 $pluginList = $plugin->getPluginDep();\r
5580                 foreach ( $pluginList as $pluginName )\r
5581                 {\r
5582                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5583                         if ($res->rowCount() == 0)\r
5584                         {\r
5585                                 // uninstall plugin again...\r
5586                                 self::deleteOnePlugin($plugin->getID());\r
5587                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5588                         }\r
5589                 }\r
5590                 \r
5591                 // call the install method of the plugin\r
5592                 $plugin->install();\r
5593                 \r
5594                 $data = array('plugin' => &$plugin);\r
5595                 $manager->notify('PostAddPlugin', $data);\r
5596                 \r
5597                 // update all events\r
5598                 self::action_pluginupdate();\r
5599                 return;\r
5600         }\r
5601         \r
5602         /**\r
5603          * ADMIN:action_pluginupdate():\r
5604          * \r
5605          * @param       Void\r
5606          * @return      Void\r
5607          * \r
5608          */\r
5609         static private function action_pluginupdate()\r
5610         {\r
5611                 global $member, $manager, $CONF;\r
5612                 \r
5613                 // check if allowed\r
5614                 $member->isAdmin() or self::disallow();\r
5615                 \r
5616                 // delete everything from plugin_events\r
5617                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5618                 \r
5619                 // loop over all installed plugins\r
5620                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5621                 foreach ( $res as $row )\r
5622                 {\r
5623                         $pid  =  $row['pid'];\r
5624                         $plug =& $manager->getPlugin($row['pfile']);\r
5625                         if ( $plug )\r
5626                         {\r
5627                                 $eventList = $plug->getEventList();\r
5628                                 foreach ( $eventList as $eventName )\r
5629                                 {\r
5630                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5631                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5632                                         DB::execute($query);\r
5633                                 }\r
5634                         }\r
5635                 }\r
5636                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5637                 return;\r
5638         }\r
5639         \r
5640         /**\r
5641          * Admin::action_plugindelete()\r
5642          * \r
5643          * @param       void\r
5644          * @return      void\r
5645          */\r
5646         static private function action_plugindelete()\r
5647         {\r
5648                 global $member, $manager;\r
5649                 \r
5650                 // check if allowed\r
5651                 $member->isAdmin() or self::disallow();\r
5652                 \r
5653                 $pid = intGetVar('plugid');\r
5654                 \r
5655                 if ( !$manager->pidInstalled($pid) )\r
5656                 {\r
5657                         self::error(_ERROR_NOSUCHPLUGIN);\r
5658                 }\r
5659                 \r
5660                 self::pagehead();\r
5661                 self::$skin->parse('plugindelete');\r
5662                 self::pagefoot();\r
5663                 return;\r
5664         }\r
5665 \r
5666         /**\r
5667          * Admin::action_plugindeleteconfirm()\r
5668          * \r
5669          * @param       void\r
5670          * @return      void\r
5671          */\r
5672         static private function action_plugindeleteconfirm()\r
5673         {\r
5674                 global $member, $manager, $CONF;\r
5675                 \r
5676                 // check if allowed\r
5677                 $member->isAdmin() or self::disallow();\r
5678                 \r
5679                 $pid = intPostVar('plugid');\r
5680                 \r
5681                 $error = self::deleteOnePlugin($pid, 1);\r
5682                 if ( $error )\r
5683                 {\r
5684                         self::error($error);\r
5685                 }\r
5686                 \r
5687                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5688                 return;\r
5689         }\r
5690         \r
5691         /**\r
5692          * Admin::\r
5693          * \r
5694          * @param       void\r
5695          * @return      void\r
5696          */\r
5697         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5698         {\r
5699                 global $manager;\r
5700                 \r
5701                 $pid = intval($pid);\r
5702                 \r
5703                 if ( !$manager->pidInstalled($pid) )\r
5704                 {\r
5705                         return _ERROR_NOSUCHPLUGIN;\r
5706                 }\r
5707                 \r
5708                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5709                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5710                 $name = DB::getValue($query);\r
5711                 \r
5712                 // check dependency before delete\r
5713                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5714                 foreach ( $res as $row )\r
5715                 {\r
5716                         $plug =& $manager->getPlugin($row['pfile']);\r
5717                         if ( $plug )\r
5718                         {\r
5719                                 $depList = $plug->getPluginDep();\r
5720                                 foreach ( $depList as $depName )\r
5721                                 {\r
5722                                         if ( $name == $depName )\r
5723                                         {\r
5724                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5725                                         }\r
5726                                 }\r
5727                         }\r
5728                 }\r
5729                 \r
5730                 $data = array('plugid' => $pid);\r
5731                 $manager->notify('PreDeletePlugin', $data);\r
5732                 \r
5733                 // call the unInstall method of the plugin\r
5734                 if ( $callUninstall )\r
5735                 {\r
5736                         $plugin =& $manager->getPlugin($name);\r
5737                         if ( $plugin )\r
5738                         {\r
5739                                 $plugin->unInstall();\r
5740                         }\r
5741                 }\r
5742                 \r
5743                 // delete all subscriptions\r
5744                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5745                 \r
5746                 // delete all options\r
5747                 // get OIDs from plugin_option_desc\r
5748                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5749                 $aOIDs = array();\r
5750                 foreach ( $res as $row )\r
5751                 {\r
5752                         array_push($aOIDs, $row['oid']);\r
5753                 }\r
5754                 \r
5755                 // delete from plugin_option and plugin_option_desc\r
5756                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5757                 if (count($aOIDs) > 0)\r
5758                 {\r
5759                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5760                 }\r
5761                 \r
5762                 // update order numbers\r
5763                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5764                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5765                 \r
5766                 // delete row\r
5767                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5768                 \r
5769                 $manager->clearCachedInfo('installedPlugins');\r
5770                 $data = array('plugid' => $pid);\r
5771                 $manager->notify('PostDeletePlugin', $data);\r
5772                 \r
5773                 return '';\r
5774         }\r
5775         \r
5776         /**\r
5777          * Admin::action_pluginup()\r
5778          * \r
5779          * @param       void\r
5780          * @return      void\r
5781          */\r
5782         static private function action_pluginup()\r
5783         {\r
5784                 global $member, $manager, $CONF;\r
5785                 \r
5786                 // check if allowed\r
5787                 $member->isAdmin() or self::disallow();\r
5788                 \r
5789                 $plugid = intGetVar('plugid');\r
5790                 \r
5791                 if ( !$manager->pidInstalled($plugid) )\r
5792                 {\r
5793                         self::error(_ERROR_NOSUCHPLUGIN);\r
5794                 }\r
5795                 \r
5796                 // 1. get old order number\r
5797                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5798                 \r
5799                 // 2. calculate new order number\r
5800                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5801                 \r
5802                 // 3. update plug numbers\r
5803                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5804                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5805                 \r
5806                 //self::action_pluginlist();\r
5807                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5808                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5809                 return;\r
5810         }\r
5811         \r
5812         /**\r
5813          * Admin::action_plugindown()\r
5814          * \r
5815          * @param       void\r
5816          * @return      void\r
5817          */\r
5818         static private function action_plugindown()\r
5819         {\r
5820                 global $member, $manager, $CONF;\r
5821                 \r
5822                 // check if allowed\r
5823                 $member->isAdmin() or self::disallow();\r
5824                 \r
5825                 $plugid = intGetVar('plugid');\r
5826                 if ( !$manager->pidInstalled($plugid) )\r
5827                 {\r
5828                         self::error(_ERROR_NOSUCHPLUGIN);\r
5829                 }\r
5830                 \r
5831                 // 1. get old order number\r
5832                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5833                 \r
5834                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5835                 $maxOrder = $res->rowCount();\r
5836                 \r
5837                 // 2. calculate new order number\r
5838                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5839                 \r
5840                 // 3. update plug numbers\r
5841                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5842                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5843                 \r
5844                 //self::action_pluginlist();\r
5845                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5846                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5847                 return;\r
5848         }\r
5849         \r
5850         /**\r
5851          * Admin::action_pluginoptions()\r
5852          * \r
5853          * Output Plugin option page\r
5854          * \r
5855          * @access      public\r
5856          * @param       string $message message when fallbacked\r
5857          * @return      void\r
5858          * \r
5859          */\r
5860         static private function action_pluginoptions($message = '')\r
5861         {\r
5862                 global $member, $manager;\r
5863                 \r
5864                 // check if allowed\r
5865                 $member->isAdmin() or self::disallow();\r
5866                 \r
5867                 $pid = intRequestVar('plugid');\r
5868                 if ( !$manager->pidInstalled($pid) )\r
5869                 {\r
5870                         self::error(_ERROR_NOSUCHPLUGIN);\r
5871                 }\r
5872                 \r
5873                 if ( isset($message) )\r
5874                 {\r
5875                         self::$headMess = $message;\r
5876                 }\r
5877                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5878                 self::pagehead($extrahead);\r
5879                 self::$skin->parse('pluginoptions');\r
5880                 self::pagefoot();\r
5881                 return;\r
5882         }\r
5883         \r
5884         /**\r
5885          * Admin::action_pluginoptionsupdate()\r
5886          * \r
5887          * Update plugin options and fallback to plugin option page\r
5888          * \r
5889          * @access      public\r
5890          * @param       void\r
5891          * @return      void\r
5892          */\r
5893         static private function action_pluginoptionsupdate()\r
5894         {\r
5895                 global $member, $manager;\r
5896                 \r
5897                 // check if allowed\r
5898                 $member->isAdmin() or self::disallow();\r
5899                 \r
5900                 $pid = intRequestVar('plugid');\r
5901                 \r
5902                 if ( !$manager->pidInstalled($pid) )\r
5903                 {\r
5904                         self::error(_ERROR_NOSUCHPLUGIN);\r
5905                 }\r
5906                 \r
5907                 $aOptions = requestArray('plugoption');\r
5908                 NucleusPlugin::apply_plugin_options($aOptions);\r
5909                 \r
5910                 $data = array(\r
5911                         'context'       => 'global',\r
5912                         'plugid'        => $pid\r
5913                 );\r
5914                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5915                 \r
5916                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5917                 return;\r
5918         }\r
5919         \r
5920         /**\r
5921          * Admin::insertPluginOptions()\r
5922          * \r
5923          * Output plugin option field\r
5924          * \r
5925          * @access      public\r
5926          * @param string        $context        plugin option context\r
5927          * @param integer       $contextid      plugin option context id\r
5928          * @return      void\r
5929          */\r
5930         static public function insertPluginOptions($context, $contextid = 0)\r
5931         {\r
5932                 global $manager;\r
5933                 \r
5934                 // get all current values for this contextid\r
5935                 // (note: this might contain doubles for overlapping contextids)\r
5936                 $aIdToValue = array();\r
5937                 \r
5938                 $query = "SELECT oid, ovalue FROM %s WHERE ocontextid=%d;";\r
5939                 $query = sprintf($query, sql_table('plugin_option'), (integer) $contextid);\r
5940                 \r
5941                 $res = DB::getResult($query);\r
5942                 foreach ( $res as $row )\r
5943                 {\r
5944                         $aIdToValue[$row['oid']] = $row['ovalue'];\r
5945                 }\r
5946                 \r
5947                 // get list of oids per pid\r
5948                 $query  = "SELECT * FROM %s, %s WHERE opid=pid and ocontext= %s ORDER BY porder, oid ASC;";\r
5949                 $query  = sprintf($query, sql_table('plugin_option_desc'), sql_table('plugin'), DB::quoteValue($context));\r
5950                 $res    = DB::getResult($query);\r
5951                 \r
5952                 $aOptions = array();\r
5953                 foreach ($res as $row )\r
5954                 {\r
5955                         if ( !in_array($row['oid'], array_keys($aIdToValue)) )\r
5956                         {\r
5957                                 $value = $row['odef'];\r
5958                         }\r
5959                         else\r
5960                         {\r
5961                                 $value = $aIdToValue[$row['oid']];\r
5962                         }\r
5963                         \r
5964                         array_push(\r
5965                                 $aOptions,\r
5966                                 array(\r
5967                                         'pid'                   => $row['pid'],\r
5968                                         'pfile'                 => $row['pfile'],\r
5969                                         'oid'                   => $row['oid'],\r
5970                                         'value'                 => $value,\r
5971                                         'name'                  => $row['oname'],\r
5972                                         'description'   => $row['odesc'],\r
5973                                         'type'                  => $row['otype'],\r
5974                                         'typeinfo'              => $row['oextra'],\r
5975                                         'contextid'             => $contextid,\r
5976                                         'extra'                 => ''\r
5977                                 )\r
5978                         );\r
5979                 }\r
5980                 \r
5981                 $data = array(\r
5982                         'context'       =>  $context,\r
5983                         'contextid'     =>  $contextid,\r
5984                         'options'       =>& $aOptions\r
5985                 );\r
5986                 $manager->notify('PrePluginOptionsEdit', $data);\r
5987                 \r
5988                 self::$aOptions = $aOptions;\r
5989                 self::$skin->parse('insertpluginoptions');\r
5990                 return;\r
5991         }\r
5992         \r
5993         /**\r
5994          * Admin::action_parseSpecialskin()\r
5995          * \r
5996          * @param       void\r
5997          * @return      void\r
5998          */\r
5999         static private function action_parseSpecialskin()\r
6000         {\r
6001                 self::pagehead();\r
6002                 self::$skin->parse(self::$action);\r
6003                 self::pagefoot();\r
6004                 return;\r
6005         }\r
6006         \r
6007         /**\r
6008          * Admin::getAdminskinIDFromName()\r
6009          * \r
6010          * @param       string  $skinname       name of skin\r
6011          * @return      integer ID for skin\r
6012          */\r
6013         static private function getAdminskinIDFromName($skinname)\r
6014         {\r
6015                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
6016                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
6017                 $admnSknID      = DB::getValue($query);\r
6018                 return (integer) $adminSkinID;\r
6019         }\r
6020         \r
6021         /**\r
6022          * Admin::getAdminskinNameFromID()\r
6023          * \r
6024          * @param       integer $skinid ID for skin\r
6025          * @return      integer ID for skin\r
6026          */\r
6027         static private function getAdminskinNameFromID($skinid)\r
6028         {\r
6029                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
6030                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
6031                 $admnSknID      = DB::getValue($query);\r
6032                 return (integer) $adminSkinID;\r
6033         }\r
6034         \r
6035         /**\r
6036          * Admin::getAdminextrahead()\r
6037          */\r
6038         static public function getAdminextrahead()\r
6039         {\r
6040                 return self::$extrahead;\r
6041         }\r
6042         \r
6043         /**\r
6044          * Admin::getAdminpassvar()\r
6045          */\r
6046         static public function getAdminpassvar()\r
6047         {\r
6048                 return self::$passvar;\r
6049         }\r
6050         \r
6051         /**\r
6052          * Admin::getAdminAction()\r
6053          */\r
6054         static public function getAdminAction()\r
6055         {\r
6056                 return self::$action;\r
6057         }\r
6058         \r
6059         /**\r
6060          * Admin::getAdminaOption()\r
6061          */\r
6062         static public function getAdminaOption()\r
6063         {\r
6064                 return self::$aOptions;\r
6065         }\r
6066         \r
6067         /**\r
6068          * Admin::action_importAdmin()\r
6069          * \r
6070          * @param       void\r
6071          * @return      void\r
6072          */\r
6073         static private function action_importAdmin()\r
6074         {\r
6075                 global $DIR_ADMINSKINS, $action;\r
6076                 if ( $action == 'adminskinieimport' )\r
6077                 {\r
6078                         self::doAdminskinimport();\r
6079                 }\r
6080                 $skn = array();\r
6081                 if ( $action == 'showlogin' )\r
6082                 {\r
6083                         $skinName = 'showlogin';\r
6084                         $actnName = 'showlogin';\r
6085                 }\r
6086                 else\r
6087                 {\r
6088                         $skinName = 'defaultimporter';\r
6089                         $actnName = 'importAdmin';\r
6090                 }\r
6091                 \r
6092                 /* TODO: why??? */\r
6093                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
6094                 $skn['id']                              = 0;\r
6095                 $skn['description']             = $skinName;\r
6096                 $skn['contentType']             = 'importAdmin';\r
6097                 $skn['includeMode']             = 'normal';\r
6098                 $skn['includePrefix']   = '';\r
6099                 $skn['name']                    = 'defaultinporter';\r
6100                 \r
6101                 self::$skin                             = (object) $skn;\r
6102                 $handler = new AdminActions($actnName, self::$skin, $this);\r
6103                 $handler->setSkin(self::$skin);\r
6104                 \r
6105                 $parser = new PARSER($handler);\r
6106                 $parser->parse($contents);\r
6107                 \r
6108                 return;\r
6109         }\r
6110         \r
6111         /**\r
6112          * Admin::doAdminskinimport()\r
6113          * \r
6114          * @param       void\r
6115          * @return      void\r
6116          */\r
6117         static private function doAdminskinimport()\r
6118         {\r
6119                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
6120                 \r
6121                 $member->isAdmin() or self::disallow();\r
6122                 \r
6123                 include_once($DIR_LIBS . 'Skinie.php');\r
6124                 $skinFileRaw    = postVar('skinfile');\r
6125                 $mode                   = postVar('mode');\r
6126                 $allowOverwrite = intPostVar('overwrite');\r
6127                 \r
6128                 if ( $mode == 'file' )\r
6129                 {\r
6130                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
6131                 }\r
6132                 else\r
6133                 {\r
6134                         $skinFile = $skinFileRaw;\r
6135                 }\r
6136                 \r
6137                 $importer       = new SKINIMPORT();\r
6138                 $error          = $importer->readFile($skinFile);\r
6139                 if ( $error )\r
6140                 {\r
6141                         self::error($error);\r
6142                 }\r
6143                 $error = $importer->writeToDatabase($allowOverwrite);\r
6144                 if ( $error )\r
6145                 {\r
6146                         self::error($error);\r
6147                 }\r
6148                 \r
6149                 $_REQUEST['skininfo']   = $importer->getInfo();\r
6150                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
6151                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
6152                 \r
6153                 header('Location: ' . $CONF['AdminURL']);\r
6154                 exit;\r
6155         }\r
6156 }\r