nucleus/libs/ADMIN.php

   1 <?php\r
   2 /**\r
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)\r
   4  * Copyright (C) 2002-2012 The Nucleus Group\r
   5  *\r
   6  * This program is free software; you can redistribute it and/or\r
   7  * modify it under the terms of the GNU General Public License\r
   8  * as published by the Free Software Foundation; either version 2\r
   9  * of the License, or (at your option) any later version.\r
  10  * (see nucleus/documentation/index.html#license for more info)\r
  11  */\r
  12 /**\r
  13  * The code for the Nucleus admin area\r
  14  *\r
  15  * @license http://nucleuscms.org/license.txt GNU General Public License\r
  16  * @copyright Copyright (C) 2002-2012 The Nucleus Group\r
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $\r
  18  */\r
  19 \r
  20 if ( !function_exists('requestVar') ) exit;\r
  21 require_once dirname(__FILE__) . '/showlist.php';\r
  22 \r
  23 class Admin\r
  24 {\r
  25         static private $xml_version_info                        = '1.0';\r
  26         static private $formal_public_identifier        = '-//W3C//DTD XHTML 1.0 Strict//EN';\r
  27         static private $system_identifier                       = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';\r
  28         static private $xhtml_namespace                 = 'http://www.w3.org/1999/xhtml';\r
  29 \r
  30         static public $headMess;\r
  31 \r
  32         static private $action;\r
  33         static private $skin;\r
  34         static private $passvar;\r
  35         static private $aOptions;\r
  36         \r
  37         static public $extrahead;\r
  38         static public $blog;\r
  39         static public $contents;\r
  40         \r
  41         /**\r
  42          * Admin::$edit_actions\r
  43          */\r
  44         static private $edit_actions = array(\r
  45                 'adminskinoverview',\r
  46                 'adminskinieoverview',\r
  47                 'adminskinedittype',\r
  48                 'adminskinremovetype',\r
  49                 'adminskindelete',\r
  50                 'adminskinedit',\r
  51                 'adminskinieimport',\r
  52                 'adminskiniedoimport',\r
  53                 'admintemplateedit',\r
  54                 'admintemplateoverview',\r
  55                 'admintemplatedelete'\r
  56         );\r
  57         \r
  58         /**\r
  59          * Admin::$skinless_actions\r
  60          */\r
  61         static private $skinless_actions = array(\r
  62                 'plugindeleteconfirm',\r
  63                 'pluginoptionsupdate',\r
  64                 'skinremovetypeconfirm',\r
  65                 'skinclone',\r
  66                 'skindeleteconfirm',\r
  67                 'skinnew',\r
  68                 'skineditgeneral',\r
  69                 'skinieexport',\r
  70                 'skinupdate',\r
  71                 'templateupdate',\r
  72                 'templatedeleteconfirm',\r
  73                 'templatenew',\r
  74                 'templateclone',\r
  75                 'adminskinremovetypeconfirm',\r
  76                 'adminskinclone',\r
  77                 'adminskindeleteconfirm',\r
  78                 'adminskinnew',\r
  79                 'adminskineditgeneral',\r
  80                 'adminskinieexport',\r
  81                 'adminskinupdate',\r
  82                 'admintemplateupdate',\r
  83                 'admintemplatedeleteconfirm',\r
  84                 'admintemplatenew',\r
  85                 'admintemplateclone',\r
  86                 'blogsettingsupdate',\r
  87                 'settingsupdate',\r
  88                 'addnewlog2',\r
  89                 'additem',\r
  90                 'itemdeleteconfirm',\r
  91                 'itemupdate',\r
  92                 'changemembersettings',\r
  93                 'clearactionlog',\r
  94                 'memberedit'\r
  95                 );\r
  96 \r
  97                 static private $actions_needless_to_check = array(\r
  98                 'showlogin',\r
  99                 'login',\r
 100                 'overview',\r
 101                 'itemlist',\r
 102                 'blogcommentlist',\r
 103                 'bookmarklet',\r
 104                 'blogsettings',\r
 105                 'banlist',\r
 106                 'createaccount',\r
 107                 'deleteblog',\r
 108                 'editmembersettings',\r
 109                 'createaccount',\r
 110                 'forgotpassword',\r
 111                 'browseowncomments',\r
 112                 'createitem',\r
 113                 'itemedit',\r
 114                 'itemmove',\r
 115                 'categoryedit',\r
 116                 'categorydelete',\r
 117                 'manage',\r
 118                 'actionlog',\r
 119                 'settingsedit',\r
 120                 'backupoverview',\r
 121                 'pluginlist',\r
 122                 'createnewlog',\r
 123                 'usermanagement',\r
 124                 'skinoverview',\r
 125                 'templateoverview',\r
 126                 'skinieoverview',\r
 127                 'itemcommentlist',\r
 128                 'commentedit',\r
 129                 'commentdelete',\r
 130                 'banlistnewfromitem',\r
 131                 'banlistdelete',\r
 132                 'itemdelete',\r
 133                 'manageteam',\r
 134                 'teamdelete',\r
 135                 'banlistnew',\r
 136                 'memberedit',\r
 137                 'memberdelete',\r
 138                 'pluginhelp',\r
 139                 'pluginoptions',\r
 140                 'plugindelete',\r
 141                 'skinedittype',\r
 142                 'skinremovetype',\r
 143                 'skindelete',\r
 144                 'skinedit',\r
 145                 'templateedit',\r
 146                 'templatedelete',\r
 147                 'activate',\r
 148                 'systemoverview',\r
 149                 'activatesetpwd',\r
 150         );\r
 151         \r
 152         static public function initialize()\r
 153         {\r
 154                 global $CONF, $DIR_LIBS, $manager;\r
 155                 \r
 156                 /* NOTE: 1. decide which skinid to use */\r
 157                 $skinid = $CONF['AdminSkin'];\r
 158                 /*\r
 159                  * NOTE: this is temporary escaped because not implemented yet\r
 160                 if (isset($member) && $member->isLoggedIn())\r
 161                 {\r
 162                         $memskin = $member->getAdminSkin();\r
 163                         if ( $memskin )\r
 164                         {\r
 165                                 $skinid = $memskin;\r
 166                         }\r
 167                 }\r
 168                 */\r
 169                 \r
 170                 /* NOTE: 2. make an instance of skin object */\r
 171                 if ( !Skin::existsID($skinid) )\r
 172                 {\r
 173                         return FALSE;\r
 174                 }\r
 175                 \r
 176                 /* NOTE: 3. initializing each members */\r
 177                 self::$skin                     =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
 178                 self::$action           = '';\r
 179                 self::$extrahead        = '';\r
 180                 self::$passvar          = '';\r
 181                 self::$headMess         = '';\r
 182                 self::$aOptions         = '';\r
 183                 return TRUE;\r
 184         }\r
 185         \r
 186         /**\r
 187          * Admin::action()\r
 188          * Executes an action\r
 189          *\r
 190          * @param       string  $action action to be performed\r
 191          * @return      void\r
 192          */\r
 193         static public function action($action)\r
 194         {\r
 195                 global $CONF, $DIR_LIBS, $manager, $member;\r
 196                 \r
 197                 /* 1. decide action name */\r
 198                 $customAction = postvar('customaction');\r
 199                 if ( !empty($customAction) )\r
 200                 {\r
 201                         $alias = array(\r
 202                                 'login' => $customAction,\r
 203                                 ''              => $customAction\r
 204                         );\r
 205                 }\r
 206                 else\r
 207                 {\r
 208                         $alias = array(\r
 209                                 'login' => 'overview',\r
 210                                 ''              => 'overview',\r
 211                         );\r
 212                 }\r
 213                 if ( array_key_exists($action, $alias) && isset($alias[$action]) )\r
 214                 {\r
 215                         $action = $alias[$action];\r
 216                 }\r
 217                 $methodName = "action_{$action}";\r
 218                 self::$action = strtolower($action);\r
 219                 \r
 220                 /* 2. check the action */\r
 221                 $synonimActions = array(\r
 222                         'banlistnewfromitem',\r
 223                         'memberedit',\r
 224                         'login',\r
 225                 );\r
 226                 $allowActions           = array_merge($synonimActions, self::$skinless_actions);\r
 227                 $aActionsNotToCheck     = array_merge(self::$actions_needless_to_check, self::$edit_actions, $allowActions);\r
 228                 if ( !in_array(self::$action, $aActionsNotToCheck) && !self::existsSkinContents($action) )\r
 229                 {\r
 230                         if (!$manager->checkTicket())\r
 231                         {\r
 232                                 self::error(_ERROR_BADTICKET);\r
 233                         }\r
 234                 }\r
 235                 \r
 236                 /* 3. parse according to the action */\r
 237                 if ( !method_exists('Admin', $methodName) && !in_array(self::$action, $allowActions) && self::existsSkinContents($action) )\r
 238                 {\r
 239                         /* TODO: what is this?\r
 240                         self::action_parseSpecialskin();\r
 241                         */\r
 242                 }\r
 243                 elseif ( method_exists('Admin', $methodName) )\r
 244                 {\r
 245                         call_user_func(array(__CLASS__, $methodName));\r
 246                 }\r
 247                 else if ( self::existsSkinContents('adminerrorpage') )\r
 248                 {\r
 249                         self::error(_BADACTION . ENTITY::hsc($action));\r
 250                 }\r
 251                 elseif ( $id != $CONF['AdminSkin'] )\r
 252                 {\r
 253                         self::$skin =& $manager->getSkin($CONF['AdminSkin'], 'AdminActions');\r
 254                         if ( self::$skin && self::existsSkinContents('adminerrorpage') )\r
 255                         {\r
 256                                 self::error(_BADACTION . ENTITY::hsc($action));\r
 257                         }\r
 258                 }\r
 259                 else\r
 260                 {\r
 261                         self::error(_BADACTION . ENTITY::hsc($action));\r
 262                 }\r
 263                 exit;\r
 264         }\r
 265         \r
 266         /**\r
 267          * Action::existsSkinContents()\r
 268          * Check skin contents\r
 269          *\r
 270          * @param       string  $action action type\r
 271          * @return      boolean\r
 272          */\r
 273         static private function existsSkinContents($action)\r
 274         {\r
 275                 $in_array  = in_array($action, self::$skinless_actions);\r
 276                 \r
 277                 if ( $in_array )\r
 278                 {\r
 279                         return $in_array;\r
 280                 }\r
 281                 else\r
 282                 {\r
 283                         $query = "SELECT scontent as result FROM %s WHERE sdesc=%d AND stype=%s";\r
 284                         /* TODO: skinid should be a default */\r
 285                         if ( !is_object(self::$skin) )\r
 286                         {\r
 287                                 global $CONF;\r
 288                                 return DB::getValue(sprintf($query, sql_table('skin'), $CONF['AdminSkin'], DB::quoteValue($action)));\r
 289                         }\r
 290                         else\r
 291                         {\r
 292                                 return DB::getValue(sprintf($query, sql_table('skin'), self::$skin->getID(), DB::quoteValue($action)));\r
 293                         }\r
 294                 }\r
 295                 return;\r
 296         }\r
 297         \r
 298         /**\r
 299          * Action::specialActionsAllow()\r
 300          * Check exists specialskinparts\r
 301          *\r
 302          * @param       string  $action action type\r
 303          * @return boolean\r
 304          */\r
 305         static private function specialActionsAllow($action)\r
 306         {\r
 307                 $query = "SELECT sdesc as result FROM %s WHERE  sdesc = %d AND stype = %s";\r
 308                 $query = sprintf($query, sql_table('skin'), (integer) self::$skin->id, DB::quoteValue($action));\r
 309                 return DB::getValue($query);\r
 310         }\r
 311         \r
 312         /**\r
 313          * Action::action_showlogin()\r
 314          * \r
 315          * @param       void\r
 316          * @return      void\r
 317          */\r
 318         static private function action_showlogin()\r
 319         {\r
 320                 global $error;\r
 321                 self::action_login($error);\r
 322                 return;\r
 323         }\r
 324         \r
 325         /**\r
 326          * Action::action_login()\r
 327          * \r
 328          * @param       string  $msg            message for pageheader\r
 329          * @param       integer $passvars       ???\r
 330          */\r
 331         static private function action_login($msg = '', $passvars = 1)\r
 332         {\r
 333                 global $member;\r
 334                 \r
 335                 // skip to overview when allowed\r
 336                 if ( $member->isLoggedIn() && $member->canLogin() )\r
 337                 {\r
 338                         self::action_overview();\r
 339                         exit;\r
 340                 }\r
 341                 \r
 342                 /* TODO: needless variable??? */\r
 343                 self::$passvar = $passvars;\r
 344                 if ( $msg )\r
 345                 {\r
 346                         self::$headMess = $msg;\r
 347                 }\r
 348                 \r
 349                 self::$skin->parse('showlogin');\r
 350         }\r
 351         \r
 352         /**\r
 353          * Action::action_overview()\r
 354          * provides a screen with the overview of the actions available\r
 355          * \r
 356          * @param       string  $msg    message for pageheader\r
 357          * @return      void\r
 358          */\r
 359         static private function action_overview($msg = '')\r
 360         {\r
 361                 if ( $msg )\r
 362                 {\r
 363                         self::$headMess = $msg;\r
 364                 }\r
 365                 \r
 366                 self::$skin->parse('overview');\r
 367                 return;\r
 368         }\r
 369         \r
 370         /**\r
 371          * Admin::action_manage()\r
 372          * \r
 373          * @param       string  $msg    message for pageheader\r
 374          * @retrn       void\r
 375          */\r
 376         static private function action_manage($msg = '')\r
 377         {\r
 378                 global $member;\r
 379                 \r
 380                 if ( $msg )\r
 381                 {\r
 382                         self::$headMess = $msg;\r
 383                 }\r
 384                 $member->isAdmin() or self::disallow();\r
 385                 \r
 386                 self::$skin->parse('manage');\r
 387                 return;\r
 388         }\r
 389         \r
 390         /**\r
 391          * Action::action_itemlist()\r
 392          * \r
 393          * @param       integer id for weblod\r
 394          * @return      void\r
 395          */\r
 396         static private function action_itemlist($blogid = '')\r
 397         {\r
 398                 global $member, $manager, $CONF;\r
 399                 \r
 400                 if ( $blogid == '' )\r
 401                 {\r
 402                         $blogid = intRequestVar('blogid');\r
 403                 }\r
 404                 \r
 405                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 406                 \r
 407                 self::$skin->parse('itemlist');\r
 408                 return;\r
 409         }\r
 410         \r
 411         /**\r
 412          * Action::action_batchitem()\r
 413          * \r
 414          * @param       void\r
 415          * @return      void\r
 416          */\r
 417         static private function action_batchitem()\r
 418         {\r
 419                 global $member, $manager;\r
 420                 \r
 421                 $member->isLoggedIn() or self::disallow();\r
 422                 \r
 423                 $selected       = requestIntArray('batch');\r
 424                 $action         = requestVar('batchaction');\r
 425                 \r
 426                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 427                 {\r
 428                         self::error(_BATCH_NOSELECTION);\r
 429                 }\r
 430                 \r
 431                 // On move: when no destination blog/category chosen, show choice now\r
 432                 $destCatid = intRequestVar('destcatid');\r
 433                 if ( ($action == 'move') && (!$manager->existsCategory($destCatid)) )\r
 434                 {\r
 435                         self::batchMoveSelectDestination('item', $selected);\r
 436                 }\r
 437                 \r
 438                 // On delete: check if confirmation has been given\r
 439                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 440                 {\r
 441                         self::batchAskDeleteConfirmation('item', $selected);\r
 442                 }\r
 443                 \r
 444                 self::$skin->parse('batchitem');\r
 445                 return;\r
 446         }\r
 447         \r
 448         /**\r
 449          * Action::action_batchcomment()\r
 450          * \r
 451          * @param       void\r
 452          * @return      void\r
 453          */\r
 454         static private function action_batchcomment()\r
 455         {\r
 456                 global $member;\r
 457                 \r
 458                 $member->isLoggedIn() or self::disallow();\r
 459                 \r
 460                 $selected       = requestIntArray('batch');\r
 461                 $action         = requestVar('batchaction');\r
 462                 \r
 463                 // Show error when no items were selected\r
 464                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 465                 {\r
 466                         self::error(_BATCH_NOSELECTION);\r
 467                 }\r
 468                 \r
 469                 // On delete: check if confirmation has been given\r
 470                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 471                 {\r
 472                         self::batchAskDeleteConfirmation('comment', $selected);\r
 473                 }\r
 474                 \r
 475                 self::$skin->parse('batchcomment');\r
 476                 return;\r
 477         }\r
 478         \r
 479         /**\r
 480          * Admin::setAdminAction()\r
 481          *\r
 482          * @param       string  $action\r
 483          * @return      void\r
 484          */\r
 485         static public function setAdminAction($action)\r
 486         {\r
 487                 self::$action = $action;\r
 488                 return;\r
 489         }\r
 490         \r
 491         /**\r
 492          * Admin::action_batchmember()\r
 493          * \r
 494          * @param       void\r
 495          * @return      void\r
 496          */\r
 497         static private function action_batchmember()\r
 498         {\r
 499                 global $member;\r
 500                 \r
 501                 ($member->isLoggedIn() && $member->isAdmin()) or self::disallow();\r
 502                 \r
 503                 $selected       = requestIntArray('batch');\r
 504                 $action         = requestVar('batchaction');\r
 505                 \r
 506                 // Show error when no members selected\r
 507                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 508                 {\r
 509                         self::error(_BATCH_NOSELECTION);\r
 510                 }\r
 511                 \r
 512                 // On delete: check if confirmation has been given\r
 513                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 514                 {\r
 515                         self::batchAskDeleteConfirmation('member',$selected);\r
 516                 }\r
 517                 \r
 518                 self::$skin->parse('batchmember');\r
 519                 return;\r
 520         }\r
 521         \r
 522         /**\r
 523          * Admin::action_batchteam()\r
 524          * \r
 525          * @param       void\r
 526          * @return      void\r
 527          */\r
 528         static private function action_batchteam()\r
 529         {\r
 530                 global $member;\r
 531                 \r
 532                 $blogid = intRequestVar('blogid');\r
 533                 \r
 534                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or self::disallow();\r
 535                 \r
 536                 $selected       = requestIntArray('batch');\r
 537                 $action         = requestVar('batchaction');\r
 538                 \r
 539                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 540                 {\r
 541                         self::error(_BATCH_NOSELECTION);\r
 542                 }\r
 543                 \r
 544                 // On delete: check if confirmation has been given\r
 545                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 546                 {\r
 547                         self::batchAskDeleteConfirmation('team',$selected);\r
 548                 }\r
 549                 \r
 550                 self::$skin->parse('batchteam');\r
 551                 return;\r
 552         }\r
 553         \r
 554         /**\r
 555          * Admin::action_batchcategory()\r
 556          * \r
 557          * @param       void\r
 558          * @return      void\r
 559          */\r
 560         static private function action_batchcategory()\r
 561         {\r
 562                 global $member, $manager;\r
 563                 \r
 564                 $member->isLoggedIn() or self::disallow();\r
 565                 \r
 566                 $selected       = requestIntArray('batch');\r
 567                 $action         = requestVar('batchaction');\r
 568                 \r
 569                 if ( !is_array($selected) || sizeof($selected) == 0 )\r
 570                 {\r
 571                         self::error(_BATCH_NOSELECTION);\r
 572                 }\r
 573                 \r
 574                 // On move: when no destination blog chosen, show choice now\r
 575                 $destBlogId = intRequestVar('destblogid');\r
 576                 if ( ($action == 'move') && (!$manager->existsBlogID($destBlogId)) )\r
 577                 {\r
 578                         self::batchMoveCategorySelectDestination('category', $selected);\r
 579                 }\r
 580                 \r
 581                 // On delete: check if confirmation has been given\r
 582                 if ( ($action == 'delete') && (requestVar('confirmation') != 'yes') )\r
 583                 {\r
 584                         self::batchAskDeleteConfirmation('category', $selected);\r
 585                 }\r
 586                 \r
 587                 self::$skin->parse('batchcategory');\r
 588                 return;\r
 589         }\r
 590         \r
 591         /**\r
 592          * Admin::batchMoveSelectDestination()\r
 593          * \r
 594          * @param       string  $type   type of batch action\r
 595          * @param       integer $ids    needless???\r
 596          * @return      void\r
 597          * \r
 598          * TODO: remove needless argument\r
 599          */\r
 600         static private function batchMoveSelectDestination($type, $ids)\r
 601         {\r
 602                 $_POST['batchmove'] = $type;\r
 603                 self::$skin->parse('batchmove');\r
 604                 return;\r
 605         }\r
 606         \r
 607         /**\r
 608          * Admin::batchMoveCategorySelectDestination()\r
 609          * \r
 610          * @param       string  $type   type of batch action\r
 611          * @param       integer $ids    needless???\r
 612          * @return      void\r
 613          * \r
 614          * TODO: remove needless argument\r
 615          */\r
 616         static private function batchMoveCategorySelectDestination($type, $ids)\r
 617         {\r
 618                 $_POST['batchmove'] = $type;\r
 619                 global $manager;\r
 620                 self::$skin->parse('batchmovecat');\r
 621                 return;\r
 622         }\r
 623         \r
 624         /**\r
 625          * Admin::batchAskDeleteConfirmation()\r
 626          * \r
 627          * @param       string  $type   type of batch action\r
 628          * @param       integer $ids    needless???\r
 629          * @return      void\r
 630          * \r
 631          * TODO: remove needless argument\r
 632          */\r
 633         static private function batchAskDeleteConfirmation($type, $ids)\r
 634         {\r
 635                 self::$skin->parse('batchdelete');\r
 636                 return;\r
 637         }\r
 638         \r
 639         /**\r
 640          * Admin::action_browseownitems()\r
 641          * \r
 642          * @param       void\r
 643          * @return      void\r
 644          */\r
 645         static private function action_browseownitems()\r
 646         {\r
 647                 global $member, $manager, $CONF;\r
 648                 \r
 649                 self::$skin->parse('browseownitems');\r
 650                 return;\r
 651         }\r
 652         \r
 653         /**\r
 654          * Admin::action_itemcommentlist()\r
 655          * Show all the comments for a given item\r
 656          * \r
 657          * @param       integer $itemid ID for item\r
 658          * @return      void\r
 659          */\r
 660         static private function action_itemcommentlist($itemid = '')\r
 661         {\r
 662                 global $member, $manager, $CONF;\r
 663                 \r
 664                 if ( $itemid == '' )\r
 665                 {\r
 666                         $itemid = intRequestVar('itemid');\r
 667                 }\r
 668                 \r
 669                 // only allow if user is allowed to alter item\r
 670                 $member->canAlterItem($itemid) or self::disallow();\r
 671                 \r
 672                 $item =& $manager->getItem($itemid, 1, 1);\r
 673                 $_REQUEST['itemid'] = $item['itemid'];\r
 674                 $_REQUEST['blogid'] = $item['blogid'];\r
 675                 \r
 676                 self::$skin->parse('itemcommentlist');\r
 677                 return;\r
 678         }\r
 679         \r
 680         /**\r
 681          * Admin::action_browseowncomments()\r
 682          * Browse own comments\r
 683          * \r
 684          * @param       void\r
 685          * @return      void\r
 686          */\r
 687         static private function action_browseowncomments()\r
 688         {\r
 689                 self::$skin->parse('browseowncomments');\r
 690                 return;\r
 691         }\r
 692         \r
 693         /**\r
 694          * Admin::action_blogcommentlist()\r
 695          * Browse all comments for a weblog\r
 696          * \r
 697          * @param       integer $blogid ID for weblog\r
 698          * @return      void\r
 699          */\r
 700         static private function action_blogcommentlist($blogid = '')\r
 701         {\r
 702                 global $member, $manager, $CONF;\r
 703                 \r
 704                 if ( $blogid == '' )\r
 705                 {\r
 706                         $blogid = intRequestVar('blogid');\r
 707                 }\r
 708                 else\r
 709                 {\r
 710                         $blogid = intval($blogid);\r
 711                 }\r
 712                 \r
 713                 $member->teamRights($blogid) or $member->isAdmin() or self::disallow();\r
 714                 \r
 715                 /* TODO: we consider to use the other way insterad of this */\r
 716                 $_REQUEST['blogid'] = $blogid;\r
 717                 \r
 718                 self::$skin->parse('blogcommentlist');\r
 719                 return;\r
 720         }\r
 721         \r
 722         /**\r
 723          * Admin::action_createaccount()\r
 724          * \r
 725          * @param       void\r
 726          * @return      void\r
 727          */\r
 728         static private function action_createaccount()\r
 729         {\r
 730                 global $CONF;\r
 731                 \r
 732                 if ( $CONF['AllowMemberCreate'] != 1 )\r
 733                 {\r
 734                         self::$skin->parse('createaccountdisable');\r
 735                         return;\r
 736                 }\r
 737                 \r
 738                 $name = '';\r
 739                 $realname ='';\r
 740                 $email = '';\r
 741                 $url = '';\r
 742                 \r
 743                 $contents = array(\r
 744                         'name'          => '',\r
 745                         'realname'      => '',\r
 746                         'email'         => '',\r
 747                         'url'           => ''\r
 748                 );\r
 749                 \r
 750                 if ( array_key_exists('showform', $_POST) && $_POST['showform'] == 1 )\r
 751                 {\r
 752                         $action = new Action();\r
 753                         $message = $action->createAccount();\r
 754                         if ( $message === 1 )\r
 755                         {\r
 756                                 self::$headMess = $message;\r
 757                                 self::$skin->parse('createaccountsuccess');\r
 758                                 return;\r
 759                         }\r
 760                         \r
 761                         /* TODO: validation */\r
 762                         if ( array_key_exists('name', $_POST) )\r
 763                         {\r
 764                                 $contents['name'] = $_POST['name'];\r
 765                         }\r
 766                         if ( array_key_exists('realname', $_POST) )\r
 767                         {\r
 768                                 $contents['realname'] = $_POST['realname'];\r
 769                         }\r
 770                         if ( array_key_exists('email', $_POST) )\r
 771                         {\r
 772                                 $contents['email'] = $_POST['email'];\r
 773                         }\r
 774                         if ( array_key_exists('url', $_POST) )\r
 775                         {\r
 776                                 $contents['url'] = $_POST['url'];\r
 777                         }\r
 778                         \r
 779                         self::$contents = $contents;\r
 780                         \r
 781                 }\r
 782                 \r
 783                 self::$skin->parse('createaccountinput');\r
 784                 return;\r
 785         }\r
 786         \r
 787         /**\r
 788          * Admin::action_createitem()\r
 789          * Provide a page to item a new item to the given blog\r
 790          * \r
 791          * @param       void\r
 792          * @return      void\r
 793          */\r
 794         static private function action_createitem()\r
 795         {\r
 796                 global $member, $manager;\r
 797                 \r
 798                 $blogid = intRequestVar('blogid');\r
 799                 \r
 800                 // check if allowed\r
 801                 $member->teamRights($blogid) or self::disallow();\r
 802                 \r
 803                 $blog =& $manager->getBlog($blogid);\r
 804                 $contents = array();\r
 805                 \r
 806                 $data = array(\r
 807                         'blog'          => &$blog,\r
 808                         'contents'      => &$contents\r
 809                 );\r
 810                 $manager->notify('PreAddItemForm', $data);\r
 811                 \r
 812                 if ( $blog->convertBreaks() )\r
 813                 {\r
 814                         if ( array_key_exists('body', $contents) && !empty($contents['body']) )\r
 815                         {\r
 816                                 $contents['body'] = removeBreaks($contents['body']);\r
 817                         }\r
 818                         if ( array_key_exists('more', $contents) && !empty($contents['more']) )\r
 819                         {\r
 820                                 $contents['more'] = removeBreaks($contents['more']);\r
 821                         }\r
 822                 }\r
 823                 \r
 824                 self::$blog = &$blog;\r
 825                 self::$contents = &$contents;\r
 826                 \r
 827                 self::$skin->parse('createitem');\r
 828                 return;\r
 829         }\r
 830         \r
 831         /**\r
 832          * Admin::action_itemedit()\r
 833          * \r
 834          * @param       void\r
 835          * @return      void\r
 836          */\r
 837         static private function action_itemedit()\r
 838         {\r
 839                 global $member, $manager;\r
 840                 \r
 841                 $itemid = intRequestVar('itemid');\r
 842                 \r
 843                 // only allow if user is allowed to alter item\r
 844                 $member->canAlterItem($itemid) or self::disallow();\r
 845                 \r
 846                 $item =& $manager->getItem($itemid, 1, 1);\r
 847                 $blog =& $manager->getBlog($item['blogid']);\r
 848                 $manager->notify('PrepareItemForEdit', array('blog'=> &$blog, 'item' => &$item));\r
 849                 \r
 850                 if ( $blog->convertBreaks() )\r
 851                 {\r
 852                         if ( array_key_exists('body', $item) && !empty($item['body']) )\r
 853                         {\r
 854                                 $item['body'] = removeBreaks($item['body']);\r
 855                         }\r
 856                         if ( array_key_exists('more', $item) && !empty($item['more']) )\r
 857                         {\r
 858                                 $item['more'] = removeBreaks($item['more']);\r
 859                         }\r
 860                 }\r
 861                 \r
 862                 self::$blog = &$blog;\r
 863                 self::$contents = &$item;\r
 864                 \r
 865                 self::$skin->parse('itemedit');\r
 866                 return;\r
 867         }\r
 868         \r
 869         /**\r
 870          * Admin::action_itemupdate()\r
 871          * \r
 872          * @param       void\r
 873          * @return      void\r
 874          */\r
 875         static private function action_itemupdate()\r
 876         {\r
 877                 global $member, $manager, $CONF;\r
 878                 \r
 879                 $itemid = intRequestVar('itemid');\r
 880                 $catid  = postVar('catid');\r
 881                 \r
 882                 // only allow if user is allowed to alter item\r
 883                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
 884                 \r
 885                 $actiontype = postVar('actiontype');\r
 886                 \r
 887                 // delete actions are handled by itemdelete (which has confirmation)\r
 888                 if ( $actiontype == 'delete' )\r
 889                 {\r
 890                         self::action_itemdelete();\r
 891                         return;\r
 892                 }\r
 893                 \r
 894                 $body           = postVar('body');\r
 895                 $title          = postVar('title');\r
 896                 $more           = postVar('more');\r
 897                 $closed         = intPostVar('closed');\r
 898                 $draftid        = intPostVar('draftid');\r
 899                 \r
 900                 // default action = add now\r
 901                 if ( !$actiontype )\r
 902                 {\r
 903                         $actiontype='addnow';\r
 904                 }\r
 905                 \r
 906                 // create new category if needed\r
 907                 if ( i18n::strpos($catid,'newcat') === 0 )\r
 908                 {\r
 909                         // get blogid\r
 910                         list($blogid) = sscanf($catid,"newcat-%d");\r
 911                         \r
 912                         // create\r
 913                         $blog =& $manager->getBlog($blogid);\r
 914                         $catid = $blog->createNewCategory();\r
 915                         \r
 916                         // show error when sth goes wrong\r
 917                         if ( !$catid )\r
 918                         {\r
 919                                 self::doError(_ERROR_CATCREATEFAIL);\r
 920                         }\r
 921                 }\r
 922                 \r
 923                 /**\r
 924                  * set some variables based on actiontype\r
 925                  * \r
 926                  * actiontypes:\r
 927                  *      draft items -> addnow, addfuture, adddraft, delete\r
 928                  *      non-draft items -> edit, changedate, delete\r
 929                  * \r
 930                  * variables set:\r
 931                  *      $timestamp: set to a nonzero value for future dates or date changes\r
 932                  *      $wasdraft: set to 1 when the item used to be a draft item\r
 933                  *      $publish: set to 1 when the edited item is not a draft\r
 934                  */\r
 935                 $blogid =  getBlogIDFromItemID($itemid);\r
 936                 $blog =& $manager->getBlog($blogid);\r
 937                 \r
 938                 $wasdrafts = array('adddraft', 'addfuture', 'addnow');\r
 939                 $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;\r
 940                 $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;\r
 941                 if ( $actiontype == 'addfuture' || $actiontype == 'changedate' )\r
 942                 {\r
 943                         $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));\r
 944                 }\r
 945                 else\r
 946                 {\r
 947                         $timestamp =0;\r
 948                 }\r
 949                 \r
 950                 // edit the item for real\r
 951                 Item::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);\r
 952                 \r
 953                 self::updateFuturePosted($blogid);\r
 954                 \r
 955                 if ( $draftid > 0 )\r
 956                 {\r
 957                         // delete permission is checked inside Item::delete()\r
 958                         Item::delete($draftid);\r
 959                 }\r
 960                 \r
 961                 if ( $catid != intPostVar('catid') )\r
 962                 {\r
 963                         self::action_categoryedit(\r
 964                                 $catid,\r
 965                                 $blog->getID(),\r
 966                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)\r
 967                         );\r
 968                 }\r
 969                 else\r
 970                 {\r
 971                         // TODO: set start item correctly for itemlist\r
 972                         $item =& $manager->getitem($itemid, 1, 1);\r
 973                         $query = "SELECT COUNT(*) FROM %s WHERE unix_timestamp(itime) <= '%s';";\r
 974                         $query = sprintf($query, sql_table('item'), $item['timestamp']);\r
 975                         $cnt  = DB::getValue($query);\r
 976                         $_REQUEST['start'] = $cnt + 1;\r
 977                         self::action_itemlist(getBlogIDFromItemID($itemid));\r
 978                 }\r
 979                 return;\r
 980         }\r
 981         \r
 982         /**\r
 983          * Admin::action_itemdelete()\r
 984          * Delete item\r
 985          * \r
 986          * @param       Void\r
 987          * @return      Void\r
 988          */\r
 989         static private function action_itemdelete()\r
 990         {\r
 991                 global $member, $manager;\r
 992                 \r
 993                 $itemid = intRequestVar('itemid');\r
 994                 \r
 995                 // only allow if user is allowed to alter item\r
 996                 $member->canAlterItem($itemid) or self::disallow();\r
 997                 \r
 998                 if ( !$manager->existsItem($itemid,1,1) )\r
 999                 {\r
1000                         self::error(_ERROR_NOSUCHITEM);\r
1001                 }\r
1002                 \r
1003                 self::$skin->parse('itemdelete');\r
1004                 return;\r
1005         }\r
1006         \r
1007         /**\r
1008          * Admin::action_itemdeleteconfirm()\r
1009          * \r
1010          * @param       void\r
1011          * @return      void\r
1012          */\r
1013         static private function action_itemdeleteconfirm()\r
1014         {\r
1015                 global $member, $manager;\r
1016                 \r
1017                 $itemid = intRequestVar('itemid');\r
1018                 \r
1019                 // only allow if user is allowed to alter item\r
1020                 $member->canAlterItem($itemid) or self::disallow();\r
1021                 \r
1022                 // get item first\r
1023                 $item =& $manager->getItem($itemid, 1, 1);\r
1024                 \r
1025                 // delete item (note: some checks will be performed twice)\r
1026                 self::deleteOneItem($item['itemid']);\r
1027                 \r
1028                 self::action_itemlist($item['blogid']);\r
1029                 return;\r
1030         }\r
1031         \r
1032         /**\r
1033          * Admin::deleteOneItem()\r
1034          * Deletes one item and returns error if something goes wrong\r
1035          * \r
1036          * @param       integer $itemid ID for item\r
1037          * @return      void\r
1038          */\r
1039         static public function deleteOneItem($itemid)\r
1040         {\r
1041                 global $member, $manager;\r
1042                 \r
1043                 // only allow if user is allowed to alter item (also checks if itemid exists)\r
1044                 if ( !$member->canAlterItem($itemid) )\r
1045                 {\r
1046                         return _ERROR_DISALLOWED;\r
1047                 }\r
1048                 \r
1049                 // need to get blogid before the item is deleted\r
1050                 $item =& $manager->getItem($itemid, 1, 1);\r
1051                 \r
1052                 $manager->loadClass('ITEM');\r
1053                 Item::delete($item['itemid']);\r
1054                 \r
1055                 // update blog's futureposted\r
1056                 self::updateFuturePosted($item['itemid']);\r
1057                 return;\r
1058         }\r
1059         \r
1060         /**\r
1061          * Admin::updateFuturePosted()\r
1062          * Update a blog's future posted flag\r
1063          * \r
1064          * @param integer $blogid\r
1065          * @return      void\r
1066          */\r
1067         static private function updateFuturePosted($blogid)\r
1068         {\r
1069                 global $manager;\r
1070                 \r
1071                 $blogid                 =  intval($blogid);\r
1072                 $blog                   =& $manager->getBlog($blogid);\r
1073                 $currenttime    =  $blog->getCorrectTime(time());\r
1074                 \r
1075                 $query = "SELECT * FROM %s WHERE iblog=%d AND iposted=0 AND itime>'%s'";\r
1076                 $query = sprintf($query, sql_table('item'), (integer) $blogid, i18n::formatted_datetime('mysql', $currenttime));\r
1077                 $result = DB::getResult($query);\r
1078                 \r
1079                 if ( $result->rowCount() > 0 )\r
1080                 {\r
1081                                 $blog->setFuturePost();\r
1082                 }\r
1083                 else\r
1084                 {\r
1085                                 $blog->clearFuturePost();\r
1086                 }\r
1087                 return;\r
1088         }\r
1089 \r
1090         /**\r
1091          * Admin::action_itemmove()\r
1092          * \r
1093          * @param       void\r
1094          * @return      void\r
1095          */\r
1096         static private function action_itemmove()\r
1097         {\r
1098                 global $member, $manager;\r
1099                 \r
1100                 $itemid = intRequestVar('itemid');\r
1101                 \r
1102                 $member->canAlterItem($itemid) or self::disallow();\r
1103                 \r
1104                 self::$skin->parse('itemmove');\r
1105                 return;\r
1106         }\r
1107         \r
1108         /**\r
1109          * Admin::action_itemmoveto()\r
1110          * \r
1111          * @param       void\r
1112          * @return      void\r
1113          */\r
1114         static private function action_itemmoveto()\r
1115         {\r
1116                 global $member, $manager;\r
1117                 \r
1118                 $itemid = intRequestVar('itemid');\r
1119                 $catid = requestVar('catid');\r
1120                 \r
1121                 // create new category if needed\r
1122                 if ( i18n::strpos($catid,'newcat') === 0 )\r
1123                 {\r
1124                         // get blogid\r
1125                         list($blogid) = sscanf($catid,'newcat-%d');\r
1126                         \r
1127                         // create\r
1128                         $blog =& $manager->getBlog($blogid);\r
1129                         $catid = $blog->createNewCategory();\r
1130                         \r
1131                         // show error when sth goes wrong\r
1132                         if ( !$catid )\r
1133                         {\r
1134                                 self::doError(_ERROR_CATCREATEFAIL);\r
1135                         }\r
1136                 }\r
1137                 \r
1138                 // only allow if user is allowed to alter item\r
1139                 $member->canUpdateItem($itemid, $catid) or self::disallow();\r
1140                 \r
1141                 $old_blogid = getBlogIDFromItemId($itemid);\r
1142                 \r
1143                 Item::move($itemid, $catid);\r
1144                 \r
1145                 // set the futurePosted flag on the blog\r
1146                 self::updateFuturePosted(getBlogIDFromItemId($itemid));\r
1147                 \r
1148                 // reset the futurePosted in case the item is moved from one blog to another\r
1149                 self::updateFuturePosted($old_blogid);\r
1150                 \r
1151                 if ( $catid != intRequestVar('catid') )\r
1152                 {\r
1153                         self::action_categoryedit($catid, $blog->getID());\r
1154                 }\r
1155                 else\r
1156                 {\r
1157                         self::action_itemlist(getBlogIDFromCatID($catid));\r
1158                 }\r
1159                 return;\r
1160         }\r
1161         \r
1162         /**\r
1163          * Admin::moveOneItem()\r
1164          * Moves one item to a given category (category existance should be checked by caller)\r
1165          * errors are returned\r
1166          * \r
1167          * @param       integer $itemid         ID for item\r
1168          * @param       integer $destCatid      ID for category to which the item will be moved\r
1169          * @return      void\r
1170          */\r
1171         static public function moveOneItem($itemid, $destCatid)\r
1172         {\r
1173                 global $member;\r
1174                 \r
1175                 // only allow if user is allowed to move item\r
1176                 if ( !$member->canUpdateItem($itemid, $destCatid) )\r
1177                 {\r
1178                         return _ERROR_DISALLOWED;\r
1179                 }\r
1180                 \r
1181                 Item::move($itemid, $destCatid);\r
1182                 return;\r
1183         }\r
1184         \r
1185         /**\r
1186          * Admin::action_additem()\r
1187          * Adds a item to the chosen blog\r
1188          * \r
1189          * @param       void\r
1190          * @return      void\r
1191          */\r
1192         static private function action_additem()\r
1193         {\r
1194                 global $manager, $CONF;\r
1195                 \r
1196                 $manager->loadClass('ITEM');\r
1197                 \r
1198                 $result = Item::createFromRequest();\r
1199                 \r
1200                 if ( $result['status'] == 'error' )\r
1201                 {\r
1202                         self::error($result['message']);\r
1203                 }\r
1204                 \r
1205                 $item =& $manager->getItem($result['itemid'], 0, 0);\r
1206                 \r
1207                 if ( $result['status'] == 'newcategory' )\r
1208                 {\r
1209                         $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . $item['blogid']);\r
1210                         self::action_categoryedit($result['catid'], $item['blogid'], $distURI);\r
1211                 }\r
1212                 else\r
1213                 {\r
1214                         $methodName = 'action_itemlist';\r
1215                         self::action_itemlist($item['blogid']);\r
1216                 }\r
1217                 return;\r
1218         }\r
1219         \r
1220         /**\r
1221          * Admin::action_commentedit()\r
1222          * Allows to edit previously made comments\r
1223          * \r
1224          * @param       void\r
1225          * @return      void\r
1226          */\r
1227         static private function action_commentedit()\r
1228         {\r
1229                 global $member, $manager;\r
1230                 \r
1231                 $commentid = intRequestVar('commentid');\r
1232                 \r
1233                 $member->canAlterComment($commentid) or self::disallow();\r
1234                 \r
1235                 self::$skin->parse('commentedit');\r
1236                 return;\r
1237         }\r
1238         \r
1239         /**\r
1240          * Admin::action_commentupdate()\r
1241          * \r
1242          * @param       void\r
1243          * @return      void\r
1244          */\r
1245         static private function action_commentupdate()\r
1246         {\r
1247                 global $member, $manager;\r
1248                 \r
1249                 $commentid = intRequestVar('commentid');\r
1250                 \r
1251                 $member->canAlterComment($commentid) or self::disallow();\r
1252                 \r
1253                 $url    = postVar('url');\r
1254                 $email  = postVar('email');\r
1255                 $body   = postVar('body');\r
1256                 \r
1257                 // intercept words that are too long\r
1258                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)\r
1259                 {\r
1260                         self::error(_ERROR_COMMENT_LONGWORD);\r
1261                 }\r
1262                 \r
1263                 // check length\r
1264                 if ( i18n::strlen($body) < 3 )\r
1265                 {\r
1266                         self::error(_ERROR_COMMENT_NOCOMMENT);\r
1267                 }\r
1268                 \r
1269                 if ( i18n::strlen($body) > 5000 )\r
1270                 {\r
1271                         self::error(_ERROR_COMMENT_TOOLONG);\r
1272                 }\r
1273                 \r
1274                 // prepare body\r
1275                 $body = Comment::prepareBody($body);\r
1276                 \r
1277                 // call plugins\r
1278                 $data = array(\r
1279                         'body' => &$body\r
1280                 );\r
1281                 $manager->notify('PreUpdateComment', $data);\r
1282                 \r
1283                 $query = "UPDATE %s SET cmail=%s, cemail=%s, cbody=%s WHERE cnumber=%d;";\r
1284                 $query = sprintf($query, sql_table('comment'), DB::quoteValue($url), DB::quoteValue($email), DB::quoteValue($body), (integer) $commentid);\r
1285                 DB::execute($query);\r
1286                 \r
1287                 // get itemid\r
1288                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1289                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1290                 \r
1291                 $itemid = DB::getValue($query);\r
1292                 \r
1293                 if ( $member->canAlterItem($itemid) )\r
1294                 {\r
1295                         self::action_itemcommentlist($itemid);\r
1296                 }\r
1297                 else\r
1298                 {\r
1299                         self::action_browseowncomments();\r
1300                 }\r
1301                 return;\r
1302         }\r
1303         \r
1304         /**\r
1305          * Admin::action_commentdelete()\r
1306          * Update comment\r
1307          * \r
1308          * @param       void\r
1309          * @return      void\r
1310          */\r
1311         static private function action_commentdelete()\r
1312         {\r
1313                 global $member, $manager;\r
1314                 \r
1315                 $commentid = intRequestVar('commentid');\r
1316                 $member->canAlterComment($commentid) or self::disallow();\r
1317                 \r
1318                 self::$skin->parse('commentdelete');\r
1319                 return;\r
1320         }\r
1321         \r
1322         /**\r
1323          * Admin::action_commentdeleteconfirm()\r
1324          * \r
1325          * @param       void\r
1326          * @return      void\r
1327          */\r
1328         static private function action_commentdeleteconfirm()\r
1329         {\r
1330                 global $member;\r
1331                 \r
1332                 $commentid = intRequestVar('commentid');\r
1333                 \r
1334                 // get item id first\r
1335                 $query = "SELECT citem FROM %s WHERE cnumber=%d;";\r
1336                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1337                 \r
1338                 $itemid = DB::getValue($query);\r
1339                 \r
1340                 $error = self::deleteOneComment($commentid);\r
1341                 if ( $error )\r
1342                 {\r
1343                         self::doError($error);\r
1344                 }\r
1345                 \r
1346                 if ( $member->canAlterItem($itemid) )\r
1347                 {\r
1348                         self::action_itemcommentlist($itemid);\r
1349                 }\r
1350                 else\r
1351                 {\r
1352                         self::action_browseowncomments();\r
1353                 }\r
1354                 return;\r
1355         }\r
1356         \r
1357         /**\r
1358          * Admin::deleteOneComment()\r
1359          * \r
1360          * @param       integer $commentid      ID for comment\r
1361          * @return      void\r
1362          */\r
1363         static public function deleteOneComment($commentid)\r
1364         {\r
1365                 global $member, $manager;\r
1366                 \r
1367                 $commentid = (integer) $commentid;\r
1368                 \r
1369                 if ( !$member->canAlterComment($commentid) )\r
1370                 {\r
1371                         return _ERROR_DISALLOWED;\r
1372                 }\r
1373                 \r
1374                 $data = array(\r
1375                         'commentid' => $commentid\r
1376                 );\r
1377                 \r
1378                 $manager->notify('PreDeleteComment', $data);\r
1379                 \r
1380                 // delete the comments associated with the item\r
1381                 $query = "DELETE FROM %s WHERE cnumber=%d;";\r
1382                 $query = sprintf($query, sql_table('comment'), (integer) $commentid);\r
1383                 DB::execute($query);\r
1384                 \r
1385                 $data = array(\r
1386                         'commentid' => $commentid\r
1387                 );\r
1388                 \r
1389                 $manager->notify('PostDeleteComment', $data);\r
1390                 \r
1391                 return '';\r
1392         }\r
1393         \r
1394         /**\r
1395          * Admin::action_usermanagement()\r
1396          * Usermanagement main\r
1397          * \r
1398          * @param       void\r
1399          * @return      void\r
1400          */\r
1401         static private function action_usermanagement()\r
1402         {\r
1403                 global $member, $manager;\r
1404                 \r
1405                 // check if allowed\r
1406                 $member->isAdmin() or self::disallow();\r
1407                 \r
1408                 self::$skin->parse('usermanagement');\r
1409                 return;\r
1410         }\r
1411         \r
1412         /**\r
1413          * Admin::action_memberedit()\r
1414          * Edit member settings\r
1415          * \r
1416          * @param       void\r
1417          * @return      void\r
1418          */\r
1419         static private function action_memberedit()\r
1420         {\r
1421                 self::action_editmembersettings(intRequestVar('memberid'));\r
1422                 return;\r
1423         }\r
1424         \r
1425         /**\r
1426          * Admin::action_editmembersettings()\r
1427          * \r
1428          * @param       integer $memberid       ID for member\r
1429          * @return      void\r
1430          * \r
1431          */\r
1432         static private function action_editmembersettings($memberid = '')\r
1433         {\r
1434                 global $member, $manager, $CONF;\r
1435                 \r
1436                 if ( $memberid == '' )\r
1437                 {\r
1438                         $memberid = $member->getID();\r
1439                 }\r
1440                 \r
1441                 /* TODO: we should consider to use the other way insterad of this */\r
1442                 $_REQUEST['memberid'] = $memberid;\r
1443                 \r
1444                 // check if allowed\r
1445                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1446                 \r
1447                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
1448                 \r
1449                 self::$skin->parse('editmembersettings');\r
1450                 return;\r
1451         }\r
1452         \r
1453         /**\r
1454          * Admin::action_changemembersettings()\r
1455          * \r
1456          * @param       void\r
1457          * @return      void\r
1458          */\r
1459         static private function action_changemembersettings()\r
1460         {\r
1461                 global $member, $CONF, $manager;\r
1462                 \r
1463                 $memberid = intRequestVar('memberid');\r
1464                 \r
1465                 // check if allowed\r
1466                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
1467                 \r
1468                 $name                   = trim(strip_tags(postVar('name')));\r
1469                 $realname               = trim(strip_tags(postVar('realname')));\r
1470                 $password               = postVar('password');\r
1471                 $repeatpassword = postVar('repeatpassword');\r
1472                 $email                  = strip_tags(postVar('email'));\r
1473                 $url                    = strip_tags(postVar('url'));\r
1474                 $adminskin              = intPostVar('adminskin');\r
1475                 \r
1476                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.\r
1477                 if ( !preg_match('#^https?://#', $url) )\r
1478                 {\r
1479                         $url = 'http://' . $url;\r
1480                 }\r
1481                 \r
1482                 $admin          = postVar('admin');\r
1483                 $canlogin       = postVar('canlogin');\r
1484                 $notes          = strip_tags(postVar('notes'));\r
1485                 $locale         = postVar('locale');\r
1486                 \r
1487                 $mem =& $manager->getMember($memberid);\r
1488                 \r
1489                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1490                 {\r
1491                         if ( !isValidDisplayName($name) )\r
1492                         {\r
1493                                 self::error(_ERROR_BADNAME);\r
1494                         }\r
1495                         \r
1496                         if ( ($name != $mem->getDisplayName()) && Member::exists($name) )\r
1497                         {\r
1498                                 self::error(_ERROR_NICKNAMEINUSE);\r
1499                         }\r
1500                         \r
1501                         if ( $password != $repeatpassword )\r
1502                         {\r
1503                                 self::error(_ERROR_PASSWORDMISMATCH);\r
1504                         }\r
1505                         \r
1506                         if ( $password && (i18n::strlen($password) < 6) )\r
1507                         {\r
1508                                 self::error(_ERROR_PASSWORDTOOSHORT);\r
1509                         }\r
1510                                 \r
1511                         if ( $password )\r
1512                         {\r
1513                                 $pwdvalid = true;\r
1514                                 $pwderror = '';\r
1515                                 \r
1516                                 $data = array(\r
1517                                         'password'     => $password,\r
1518                                         'errormessage' => &$pwderror,\r
1519                                         'valid'        => &$pwdvalid\r
1520                                 );\r
1521                                 $manager->notify('PrePasswordSet', $data);\r
1522                                 \r
1523                                 if ( !$pwdvalid )\r
1524                                 {\r
1525                                         self::error($pwderror);\r
1526                                 }\r
1527                         }\r
1528                 }\r
1529                 \r
1530                 if ( !NOTIFICATION::address_validation($email) )\r
1531                 {\r
1532                         self::error(_ERROR_BADMAILADDRESS);\r
1533                 }\r
1534                 if ( !$realname )\r
1535                 {\r
1536                         self::error(_ERROR_REALNAMEMISSING);\r
1537                 }\r
1538                 if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )\r
1539                 {\r
1540                         self::error(_ERROR_NOSUCHTRANSLATION);\r
1541                 }\r
1542                 \r
1543                 // check if there will remain at least one site member with both the logon and admin rights\r
1544                 // (check occurs when taking away one of these rights from such a member)\r
1545                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())\r
1546                         ||      (!$canlogin && $mem->isAdmin() && $mem->canLogin())\r
1547                         )\r
1548                 {\r
1549                         $r = DB::getResult('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');\r
1550                         if ( $r->rowCount() < 2 )\r
1551                         {\r
1552                                 self::error(_ERROR_ATLEASTONEADMIN);\r
1553                         }\r
1554                 }\r
1555                 \r
1556                 if ( $CONF['AllowLoginEdit'] || $member->isAdmin() )\r
1557                 {\r
1558                         $mem->setDisplayName($name);\r
1559                         if ( $password )\r
1560                         {\r
1561                                 $mem->setPassword($password);\r
1562                         }\r
1563                 }\r
1564                 \r
1565                 $oldEmail = $mem->getEmail();\r
1566                 \r
1567                 $mem->setRealName($realname);\r
1568                 $mem->setEmail($email);\r
1569                 $mem->setURL($url);\r
1570                 $mem->setNotes($notes);\r
1571                 $mem->setLocale($locale);\r
1572                 \r
1573                 // only allow super-admins to make changes to the admin status\r
1574                 if ( $member->isAdmin() )\r
1575                 {\r
1576                         $mem->setAdmin($admin);\r
1577                         $mem->setCanLogin($canlogin);\r
1578                 }\r
1579                 \r
1580                 $autosave = postVar('autosave');\r
1581                 $mem->setAutosave($autosave);\r
1582                 \r
1583                 $mem->write();\r
1584                 \r
1585                 // store plugin options\r
1586                 $aOptions = requestArray('plugoption');\r
1587                 NucleusPlugin::apply_plugin_options($aOptions);\r
1588                 $data = array(\r
1589                         'context'  => 'member',\r
1590                         'memberid' => $memberid,\r
1591                         'member'   => &$mem\r
1592                 );\r
1593                 $manager->notify('PostPluginOptionsUpdate', $data);\r
1594                 \r
1595                 // if email changed, generate new password\r
1596                 if ( $oldEmail != $mem->getEmail() )\r
1597                 {\r
1598                         $mem->sendActivationLink('addresschange', $oldEmail);\r
1599                         // logout member\r
1600                         $mem->newCookieKey();\r
1601                         \r
1602                         // only log out if the member being edited is the current member.\r
1603                         if ( $member->getID() == $memberid )\r
1604                         {\r
1605                                 $member->logout();\r
1606                         }\r
1607                         self::action_login(_MSG_ACTIVATION_SENT, 0);\r
1608                         return;\r
1609                 }\r
1610                 \r
1611                 if ( ($mem->getID() == $member->getID())\r
1612                         && ($mem->getDisplayName() != $member->getDisplayName()) )\r
1613                 {\r
1614                         $mem->newCookieKey();\r
1615                         $member->logout();\r
1616                         self::action_login(_MSG_LOGINAGAIN, 0);\r
1617                 }\r
1618                 else\r
1619                 {\r
1620                         self::action_overview(_MSG_SETTINGSCHANGED);\r
1621                 }\r
1622                 return;\r
1623         }\r
1624 \r
1625         /**\r
1626          * Admin::action_memberadd()\r
1627          * \r
1628          * @param       void\r
1629          * @return      void\r
1630          * \r
1631          */\r
1632         static private function action_memberadd()\r
1633         {\r
1634                 global $member, $manager;\r
1635                 \r
1636                 // check if allowed\r
1637                 $member->isAdmin() or self::disallow();\r
1638                 \r
1639                 if ( postVar('password') != postVar('repeatpassword') )\r
1640                 {\r
1641                         self::error(_ERROR_PASSWORDMISMATCH);\r
1642                 }\r
1643                 \r
1644                 if ( i18n::strlen(postVar('password')) < 6 )\r
1645                 {\r
1646                         self::error(_ERROR_PASSWORDTOOSHORT);\r
1647                 }\r
1648                 \r
1649                 $res = Member::create(\r
1650                         postVar('name'),\r
1651                         postVar('realname'),\r
1652                         postVar('password'),\r
1653                         postVar('email'),\r
1654                         postVar('url'),\r
1655                         postVar('admin'),\r
1656                         postVar('canlogin'),\r
1657                         postVar('notes')\r
1658                 );\r
1659                 \r
1660                 if ( $res != 1 )\r
1661                 {\r
1662                         self::error($res);\r
1663                 }\r
1664                 \r
1665                 // fire PostRegister event\r
1666                 $newmem = new Member();\r
1667                 $newmem->readFromName(postVar('name'));\r
1668                 $data = array(\r
1669                         'member' => &$newmem\r
1670                 );\r
1671                 $manager->notify('PostRegister', $data);\r
1672                 \r
1673                 self::action_usermanagement();\r
1674                 return;\r
1675         }\r
1676         \r
1677         /**\r
1678          * Admin::action_forgotpassword()\r
1679          * \r
1680          * @param       void\r
1681          * @return      void\r
1682          */\r
1683         static private function action_forgotpassword()\r
1684         {\r
1685                 self::$skin->parse('forgotpassword');\r
1686                 return;\r
1687         }\r
1688         \r
1689         /**\r
1690          * Admin::action_activate()\r
1691          * Account activation\r
1692          * \r
1693          * @param       void\r
1694          * @return      void\r
1695          */\r
1696         static private function action_activate()\r
1697         {\r
1698                 $key = getVar('key');\r
1699                 self::showActivationPage($key);\r
1700                 return;\r
1701         }\r
1702         \r
1703         /**\r
1704          * Admin::showActivationPage()\r
1705          * \r
1706          * @param       void\r
1707          * @return      void\r
1708          */\r
1709         static private function showActivationPage($key, $message = '')\r
1710         {\r
1711                 global $manager;\r
1712                 \r
1713                 // clean up old activation keys\r
1714                 Member::cleanupActivationTable();\r
1715                 \r
1716                 // get activation info\r
1717                 $info = Member::getActivationInfo($key);\r
1718                 \r
1719                 if ( !$info )\r
1720                 {\r
1721                         self::error(_ERROR_ACTIVATE);\r
1722                 }\r
1723                 \r
1724                 $mem =& $manager->getMember($info->vmember);\r
1725                 \r
1726                 if ( !$mem )\r
1727                 {\r
1728                         self::error(_ERROR_ACTIVATE);\r
1729                 }\r
1730                 \r
1731                 /* TODO: we should consider to use the other way insterad of this */\r
1732                 $_POST['ackey']                                 = $key;\r
1733                 $_POST['bNeedsPasswordChange']  = TRUE;\r
1734                 \r
1735                 self::$headMess = $message;\r
1736                 self::$skin->parse('activate');\r
1737                 return;\r
1738         }\r
1739         \r
1740         /**\r
1741          * Admin::action_activatesetpwd()\r
1742          * Account activation - set password part\r
1743          * \r
1744          * @param       void\r
1745          * @return      void\r
1746          */\r
1747         static private function action_activatesetpwd()\r
1748         {\r
1749                 global $manager;\r
1750                 $key = postVar('key');\r
1751                 \r
1752                 // clean up old activation keys\r
1753                 Member::cleanupActivationTable();\r
1754                 \r
1755                 // get activation info\r
1756                 $info = Member::getActivationInfo($key);\r
1757                 \r
1758                 if ( !$info || ($info->type == 'addresschange') )\r
1759                 {\r
1760                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1761                 }\r
1762                 \r
1763                 $mem =& $manager->getMember($info->vmember);\r
1764                 \r
1765                 if ( !$mem )\r
1766                 {\r
1767                         return self::showActivationPage($key, _ERROR_ACTIVATE);\r
1768                 }\r
1769                 \r
1770                 $password               = postVar('password');\r
1771                 $repeatpassword = postVar('repeatpassword');\r
1772                 \r
1773                 if ( $password != $repeatpassword )\r
1774                 {\r
1775                         return self::showActivationPage($key, _ERROR_PASSWORDMISMATCH);\r
1776                 }\r
1777                 \r
1778                 if ( $password && (i18n::strlen($password) < 6) )\r
1779                 {\r
1780                         return self::showActivationPage($key, _ERROR_PASSWORDTOOSHORT);\r
1781                 }\r
1782                         \r
1783                 if ( $password )\r
1784                 {\r
1785                         $pwdvalid = true;\r
1786                         $pwderror = '';\r
1787                         \r
1788                         $data = array(\r
1789                                 'password'              => $password,\r
1790                                 'errormessage'  => &$pwderror,\r
1791                                 'valid'                 => &$pwdvalid\r
1792                         );\r
1793                         $manager->notify('PrePasswordSet', $data);\r
1794                         if ( !$pwdvalid )\r
1795                         {\r
1796                                 return self::showActivationPage($key,$pwderror);\r
1797                         }\r
1798                 }\r
1799                 \r
1800                 $error = '';\r
1801                 \r
1802                 $data = array(\r
1803                         'type'   => 'activation',\r
1804                         'member' => $mem,\r
1805                         'error'  => &$error\r
1806                 );\r
1807                 $manager->notify('ValidateForm', $data);\r
1808                 if ( $error != '' )\r
1809                 {\r
1810                         return self::showActivationPage($key, $error);\r
1811                 }\r
1812                 \r
1813                 // set password\r
1814                 $mem->setPassword($password);\r
1815                 $mem->write();\r
1816                 \r
1817                 // do the activation\r
1818                 Member::activate($key);\r
1819                 \r
1820                 self::$skin->parse('activatesetpwd');\r
1821                 return;\r
1822         }\r
1823         \r
1824         /**\r
1825          * Admin::action_manageteam()\r
1826          * Manage team\r
1827          * \r
1828          * @param       void\r
1829          * @return      void\r
1830          */\r
1831         static private function action_manageteam()\r
1832         {\r
1833                 global $member, $manager;\r
1834                 \r
1835                 $blogid = intRequestVar('blogid');\r
1836                 \r
1837                 // check if allowed\r
1838                 $member->blogAdminRights($blogid) or self::disallow();\r
1839                 \r
1840                 self::$skin->parse('manageteam');\r
1841                 return;\r
1842         }\r
1843         \r
1844         /**\r
1845          * Admin::action_teamaddmember()\r
1846          * Add member to team\r
1847          * \r
1848          * @param       void\r
1849          * @return      void\r
1850          */\r
1851         static private function action_teamaddmember()\r
1852         {\r
1853                 global $member, $manager;\r
1854                 \r
1855                 $memberid       = intPostVar('memberid');\r
1856                 $blogid         = intPostVar('blogid');\r
1857                 $admin          = intPostVar('admin');\r
1858                 \r
1859                 // check if allowed\r
1860                 $member->blogAdminRights($blogid) or self::disallow();\r
1861                 \r
1862                 $blog =& $manager->getBlog($blogid);\r
1863                 if ( !$blog->addTeamMember($memberid, $admin) )\r
1864                 {\r
1865                         self::error(_ERROR_ALREADYONTEAM);\r
1866                 }\r
1867                 \r
1868                 self::action_manageteam();\r
1869                 return;\r
1870         }\r
1871         \r
1872         /**\r
1873          * Admin::action_teamdelete()\r
1874          * \r
1875          * @param       void\r
1876          * @return      void\r
1877          */\r
1878         static private function action_teamdelete()\r
1879         {\r
1880                 global $member, $manager;\r
1881                 \r
1882                 $memberid       = intRequestVar('memberid');\r
1883                 $blogid         = intRequestVar('blogid');\r
1884                 \r
1885                 // check if allowed\r
1886                 $member->blogAdminRights($blogid) or self::disallow();\r
1887                 \r
1888                 $teammem =& $manager->getMember($memberid);\r
1889                 $blog =& $manager->getBlog($blogid);\r
1890                 \r
1891                 self::$skin->parse('teamdelete');\r
1892                 return;\r
1893         }\r
1894         \r
1895         /**\r
1896          * Admin::action_teamdeleteconfirm()\r
1897          * \r
1898          * @param       void\r
1899          * @return      void\r
1900          */\r
1901         static private function action_teamdeleteconfirm()\r
1902         {\r
1903                 global $member;\r
1904                 \r
1905                 $memberid = intRequestVar('memberid');\r
1906                 $blogid = intRequestVar('blogid');\r
1907                 \r
1908                 $error = self::deleteOneTeamMember($blogid, $memberid);\r
1909                 if ( $error )\r
1910                 {\r
1911                         self::error($error);\r
1912                 }\r
1913                 self::action_manageteam();\r
1914                 return;\r
1915         }\r
1916         \r
1917         /**\r
1918          * Admin::deleteOneTeamMember()\r
1919          * \r
1920          * @param       void\r
1921          * @return      void\r
1922          */\r
1923         static public function deleteOneTeamMember($blogid, $memberid)\r
1924         {\r
1925                 global $member, $manager;\r
1926                 \r
1927                 $blogid   = intval($blogid);\r
1928                 $memberid = intval($memberid);\r
1929                 \r
1930                 // check if allowed\r
1931                 if ( !$member->blogAdminRights($blogid) )\r
1932                 {\r
1933                         return _ERROR_DISALLOWED;\r
1934                 }\r
1935                 \r
1936                 // check if: - there remains at least one blog admin\r
1937                 //           - (there remains at least one team member)\r
1938                 $tmem =& $manager->getMember($memberid);\r
1939                 \r
1940                 \r
1941                 $data = array(\r
1942                         'member' => &$tmem,\r
1943                         'blogid' => $blogid\r
1944                 );\r             $manager->notify('PreDeleteTeamMember', $data);\r
1945                 \r
1946                 if ( $tmem->isBlogAdmin($blogid) )\r
1947                 {\r
1948                         /* TODO: why we did double check? */\r
1949                         // check if there are more blog members left and at least one admin\r
1950                         // (check for at least two admins before deletion)\r
1951                         $query = "SELECT * FROM %s WHERE tblog=%d and tadmin=1;";\r
1952                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1953                         $r     = DB::getResult($query);\r
1954                         if ( $r->rowCount() < 2 )\r
1955                         {\r
1956                                 return _ERROR_ATLEASTONEBLOGADMIN;\r
1957                         }\r
1958                 }\r
1959                 \r
1960                 $query = "DELETE FROM %s WHERE tblog=%d AND tmember=%d;";\r
1961                 $query = sprintf($query, sql_table('team'), (integer) $blogid, (integer) $memberid);\r
1962                 DB::execute($query);\r
1963                 \r
1964                 $data = array(\r
1965                         'member' => &$tmem,\r
1966                         'blogid' => $blogid\r
1967                 );\r
1968                 $manager->notify('PostDeleteTeamMember', $data);\r
1969                 \r
1970                 return '';\r
1971         }\r
1972         \r
1973         /**\r
1974          * Admin::action_teamchangeadmin()\r
1975          * \r
1976          * @param       void\r
1977          * @return      void\r
1978          */\r
1979         static private function action_teamchangeadmin()\r
1980         {\r
1981                 global $manager, $member;\r
1982                 \r
1983                 $blogid         = intRequestVar('blogid');\r
1984                 $memberid       = intRequestVar('memberid');\r
1985                 \r
1986                 // check if allowed\r
1987                 $member->blogAdminRights($blogid) or self::disallow();\r
1988                 \r
1989                 $mem =& $manager->getMember($memberid);\r
1990                 \r
1991                 // don't allow when there is only one admin at this moment\r
1992                 if ( $mem->isBlogAdmin($blogid) )\r
1993                 {\r
1994                         $query = "SELECT * FROM %s WHERE tblog=%d AND tadmin=1;";\r
1995                         $query = sprintf($query, sql_table('team'), (integer) $blogid);\r
1996                         $r = DB::getResult($query);\r
1997                         if ( $r->rowCount() == 1 )\r
1998                         {\r
1999                                 self::error(_ERROR_ATLEASTONEBLOGADMIN);\r
2000                         }\r
2001                 }\r
2002                 \r
2003                 if ( $mem->isBlogAdmin($blogid) )\r
2004                 {\r
2005                         $newval = 0;\r
2006                 }\r
2007                 else\r
2008                 {\r
2009                         $newval = 1;\r
2010                 }\r
2011                 \r
2012                 $query = "UPDATE %s SET tadmin=%d WHERE tblog=%d and tmember=%d;";\r
2013                 $query = sprintf($query, (integer) $blogid, (integer) $newval, (integer) $blogid, (integer) $memberid);\r
2014                 DB::execute($query);\r
2015                 \r
2016                 // only show manageteam if member did not change its own admin privileges\r
2017                 if ( $member->isBlogAdmin($blogid) )\r
2018                 {\r
2019                         self::action_manageteam();\r
2020                 }\r
2021                 else\r
2022                 {\r
2023                         self::action_overview(_MSG_ADMINCHANGED);\r
2024                 }\r
2025                 return;\r
2026         }\r
2027         \r
2028         /**\r
2029          * Admin::action_blogsettings()\r
2030          * \r
2031          * @param       void\r
2032          * @return      void\r
2033          */\r
2034         static private function action_blogsettings()\r
2035         {\r
2036                 global $member, $manager;\r
2037                 \r
2038                 $blogid = intRequestVar('blogid');\r
2039                 \r
2040                 // check if allowed\r
2041                 $member->blogAdminRights($blogid) or self::disallow();\r
2042                 \r
2043                 $blog =& $manager->getBlog($blogid);\r
2044                 \r
2045                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2046                 \r
2047                 self::$skin->parse('blogsettings');\r
2048                 return;\r
2049         }\r
2050         \r
2051         /**\r
2052          * Admin::action_categorynew()\r
2053          * \r
2054          * @param       void\r
2055          * @return      void\r
2056          */\r
2057         static private function action_categorynew()\r
2058         {\r
2059                 global $member, $manager;\r
2060                 \r
2061                 $blogid = intRequestVar('blogid');\r
2062                 \r
2063                 $member->blogAdminRights($blogid) or self::disallow();\r
2064                 \r
2065                 $cname = postVar('cname');\r
2066                 $cdesc = postVar('cdesc');\r
2067                 \r
2068                 if ( !isValidCategoryName($cname) )\r
2069                 {\r
2070                         self::error(_ERROR_BADCATEGORYNAME);\r
2071                 }\r
2072                 \r
2073                 $query = "SELECT * FROM %s WHERE cname=%s AND cblog=%d;";\r
2074                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid);\r
2075                 $res = DB::getResult($query);\r
2076                 if ( $res->rowCount() > 0 )\r
2077                 {\r
2078                         self::error(_ERROR_DUPCATEGORYNAME);\r
2079                 }\r
2080                 \r
2081                 $blog           =& $manager->getBlog($blogid);\r
2082                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);\r
2083                 \r
2084                 self::action_blogsettings();\r
2085                 return;\r
2086         }\r
2087         \r
2088         /**\r
2089          * Admin::action_categoryedit()\r
2090          * \r
2091          * @param       void\r
2092          * @return      void\r
2093          */\r
2094         static private function action_categoryedit($catid = '', $blogid = '', $desturl = '')\r
2095         {\r
2096                 global $member, $manager;\r
2097                 \r
2098                 if ( $blogid == '' )\r
2099                 {\r
2100                         $blogid = intGetVar('blogid');\r
2101                 }\r
2102                 else\r
2103                 {\r
2104                         $blogid = intval($blogid);\r
2105                 }\r
2106                 if ( $catid == '' )\r
2107                 {\r
2108                         $catid = intGetVar('catid');\r
2109                 }\r
2110                 else\r
2111                 {\r
2112                         $catid = intval($catid);\r
2113                 }\r
2114                 \r
2115                 /* TODO: we should consider to use the other way insterad of this */\r
2116                 $_REQUEST['blogid']             = $blogid;\r
2117                 $_REQUEST['catid']              = $catid;\r
2118                 $_REQUEST['desturl']    = $desturl;\r
2119                 $member->blogAdminRights($blogid) or self::disallow();\r
2120                 \r
2121                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
2122                 \r
2123                 self::$skin->parse('categoryedit');\r
2124                 return;\r
2125         }\r
2126         \r
2127         /**\r
2128          * Admin::action_categoryupdate()\r
2129          * \r
2130          * @param       void\r
2131          * @return      void\r
2132          */\r
2133         static private function action_categoryupdate()\r
2134         {\r
2135                 global $member, $manager;\r
2136                 \r
2137                 $blogid         = intPostVar('blogid');\r
2138                 $catid          = intPostVar('catid');\r
2139                 $cname          = postVar('cname');\r
2140                 $cdesc          = postVar('cdesc');\r
2141                 $desturl        = postVar('desturl');\r
2142                 \r
2143                 $member->blogAdminRights($blogid) or self::disallow();\r
2144                 \r
2145                 if ( !isValidCategoryName($cname) )\r
2146                 {\r
2147                         self::error(_ERROR_BADCATEGORYNAME);\r
2148                 }\r
2149                 \r
2150                 $query  = "SELECT * FROM %s WHERE cname=%s AND cblog=%d AND not(catid=%d);";\r
2151                 $query  = sprintf($query, sql_table('category'), DB::quoteValue($cname), (integer) $blogid, (integer) $catid);\r
2152                 $res    = DB::getResult($query);\r
2153                 if ( $res->rowCount() > 0 )\r
2154                 {\r
2155                         self::error(_ERROR_DUPCATEGORYNAME);\r
2156                 }\r
2157                 \r
2158                 $query =  "UPDATE %s SET cname=%s, cdesc=%s WHERE catid=%d;";\r
2159                 $query = sprintf($query, sql_table('category'), DB::quoteValue($cname), DB::quoteValue($cdesc), (integer) $catid);\r
2160                 DB::execute($query);\r
2161                 \r
2162                 // store plugin options\r
2163                 $aOptions = requestArray('plugoption');\r
2164                 NucleusPlugin::apply_plugin_options($aOptions);\r
2165                 $data = array(\r
2166                         'context'       => 'category',\r
2167                         'catid'         => $catid\r
2168                 );\r
2169                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2170                 \r
2171                 if ( $desturl )\r
2172                 {\r
2173                         redirect($desturl);\r
2174                         exit;\r
2175                 }\r
2176                 else\r
2177                 {\r
2178                         self::action_blogsettings();\r
2179                 }\r
2180                 return;\r
2181         }\r
2182         \r
2183         /**\r
2184          * Admin::action_categorydelete()\r
2185          * \r
2186          * @param       void\r
2187          * @return      void\r
2188          */\r
2189         static private function action_categorydelete()\r
2190         {\r
2191                 global $member, $manager;\r
2192                 \r
2193                 $blogid = intRequestVar('blogid');\r
2194                 $catid  = intRequestVar('catid');\r
2195                 \r
2196                 $member->blogAdminRights($blogid) or self::disallow();\r
2197                 \r
2198                 $blog =& $manager->getBlog($blogid);\r
2199                 \r
2200                 // check if the category is valid\r
2201                 if ( !$blog->isValidCategory($catid) )\r
2202                 {\r
2203                         self::error(_ERROR_NOSUCHCATEGORY);\r
2204                 }\r
2205                 \r
2206                 // don't allow deletion of default category\r
2207                 if ( $blog->getDefaultCategory() == $catid )\r
2208                 {\r
2209                         self::error(_ERROR_DELETEDEFCATEGORY);\r
2210                 }\r
2211                 \r
2212                 // check if catid is the only category left for blogid\r
2213                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2214                 $query = sprintf($query, sql_table('category'), $blogid);\r
2215                 $res = DB::getResult($query);\r
2216                 if ( $res->rowCount() == 1 )\r
2217                 {\r
2218                         self::error(_ERROR_DELETELASTCATEGORY);\r
2219                 }\r
2220                 \r
2221                 self::$skin->parse('categorydelete');\r
2222                 return;\r
2223         }\r
2224         \r
2225         /**\r
2226          * Admin::action_categorydeleteconfirm()\r
2227          * \r
2228          * @param       void\r
2229          * @return      void\r
2230          */\r
2231         static private function action_categorydeleteconfirm()\r
2232         {\r
2233                 global $member, $manager;\r
2234                 \r
2235                 $blogid = intRequestVar('blogid');\r
2236                 $catid  = intRequestVar('catid');\r
2237                 \r
2238                 $member->blogAdminRights($blogid) or self::disallow();\r
2239                 \r
2240                 $error = self::deleteOneCategory($catid);\r
2241                 if ( $error )\r
2242                 {\r
2243                         self::error($error);\r
2244                 }\r
2245                 \r
2246                 self::action_blogsettings();\r
2247                 return;\r
2248         }\r
2249         \r
2250         /**\r
2251          * Admin::deleteOneCategory()\r
2252          * Delete a category by its id\r
2253          * \r
2254          * @param       String  $catid  category id for deleting\r
2255          * @return      Void\r
2256          */\r
2257         static public function deleteOneCategory($catid)\r
2258         {\r
2259                 global $manager, $member;\r
2260                 \r
2261                 $catid  = intval($catid);\r
2262                 $blogid = getBlogIDFromCatID($catid);\r
2263                 \r
2264                 if ( !$member->blogAdminRights($blogid) )\r
2265                 {\r
2266                         return ERROR_DISALLOWED;\r
2267                 }\r
2268                 \r
2269                 // get blog\r
2270                 $blog =& $manager->getBlog($blogid);\r
2271                 \r
2272                 // check if the category is valid\r
2273                 if ( !$blog || !$blog->isValidCategory($catid) )\r
2274                 {\r
2275                         return _ERROR_NOSUCHCATEGORY;\r
2276                 }\r
2277                 \r
2278                 $destcatid = $blog->getDefaultCategory();\r
2279                 \r
2280                 // don't allow deletion of default category\r
2281                 if ( $blog->getDefaultCategory() == $catid )\r
2282                 {\r
2283                         return _ERROR_DELETEDEFCATEGORY;\r
2284                 }\r
2285                 \r
2286                 // check if catid is the only category left for blogid\r
2287                 $query = "SELECT catid FROM %s WHERE cblog=%d;";\r
2288                 $query = sprintf($query, sql_table('category'), (integer) $blogid);\r
2289                 \r
2290                 $res = DB::getResult($query);\r
2291                 if ( $res->rowCount() == 1 )\r
2292                 {\r
2293                         return _ERROR_DELETELASTCATEGORY;\r
2294                 }\r
2295                 \r
2296                 $data = array('catid' => $catid);\r
2297                 $manager->notify('PreDeleteCategory', $data);\r
2298                 \r
2299                 // change category for all items to the default category\r
2300                 $query = "UPDATE %s SET icat=%d WHERE icat=%d;";\r
2301                 $query =sprintf($query, sql_table('item'), (integer) $destcatid, (integer) $catid);\r
2302                 DB::execute($query);\r
2303                 \r
2304                 // delete all associated plugin options\r
2305                 NucleusPlugin::delete_option_values('category', (integer) $catid);\r
2306                 \r
2307                 // delete category\r
2308                 $query = "DELETE FROM %s WHERE catid=%d;";\r
2309                 $query = sprintf($query, sql_table('category'), (integer) $catid);\r
2310                 DB::execute($query);\r
2311                 \r
2312                 $data = array('catid' => $catid);\r
2313                 $manager->notify('PostDeleteCategory', $data);\r
2314                 return;\r
2315         }\r
2316         \r
2317         /**\r
2318          * Admin::moveOneCategory()\r
2319          * Delete a category by its id\r
2320          * \r
2321          * @param       int     $catid          category id for move\r
2322          * @param       int     $destblogid     blog id for destination\r
2323          * @return      void\r
2324          */\r
2325         static public function moveOneCategory($catid, $destblogid)\r
2326         {\r
2327                 global $manager, $member;\r
2328                 $catid      = intval($catid);\r
2329                 $destblogid = intval($destblogid);\r
2330                 $blogid     = getBlogIDFromCatID($catid);\r
2331                 // mover should have admin rights on both blogs\r
2332                 if (!$member->blogAdminRights($blogid)) {\r
2333                         return _ERROR_DISALLOWED;\r
2334                 }\r
2335                 if (!$member->blogAdminRights($destblogid)) {\r
2336                         return _ERROR_DISALLOWED;\r
2337                 }\r
2338                 // cannot move to self\r
2339                 if ($blogid == $destblogid) {\r
2340                         return _ERROR_MOVETOSELF;\r
2341                 }\r
2342                 // get blogs\r
2343                 $blog     =& $manager->getBlog($blogid);\r
2344                 $destblog =& $manager->getBlog($destblogid);\r
2345                 // check if the category is valid\r
2346                 if (!$blog || !$blog->isValidCategory($catid)) {\r
2347                         return _ERROR_NOSUCHCATEGORY;\r
2348                 }\r
2349                 // don't allow default category to be moved\r
2350                 if ($blog->getDefaultCategory() == $catid) {\r
2351                         return _ERROR_MOVEDEFCATEGORY;\r
2352                 }\r
2353                 $manager->notify(\r
2354                                 'PreMoveCategory',\r
2355                                 array(\r
2356                                                 'catid'      => &$catid,\r
2357                                                 'sourceblog' => &$blog,\r
2358                                                 'destblog'   => &$destblog\r
2359                                 )\r
2360                 );\r
2361                 // update comments table (cblog)\r
2362                 $query = 'SELECT '\r
2363                 . '    inumber '\r
2364                 . 'FROM '\r
2365                 .      sql_table('item') . ' '\r
2366                 . 'WHERE '\r
2367                 . '    icat = %d';\r
2368                 $items = sql_query(sprintf($query, $catid));\r
2369                 while ($oItem = sql_fetch_object($items)) {\r
2370                         $query = 'UPDATE '\r
2371                         .      sql_table('comment') . ' '\r
2372                         . 'SET '\r
2373                         . '    cblog = %d' . ' '\r
2374                         . 'WHERE '\r
2375                         . '    citem = %d';\r
2376                         sql_query(sprintf($query, $destblogid, $oItem->inumber));\r
2377                 }\r
2378         \r
2379                 // update items (iblog)\r
2380                 $query = 'UPDATE '\r
2381                 .      sql_table('item') . ' '\r
2382                 . 'SET '\r
2383                 . '    iblog = %d '\r
2384                 . 'WHERE '\r
2385                 . '    icat = %d';\r
2386                 sql_query(sprintf($query, $destblogid, $catid));\r
2387         \r
2388                 // move category\r
2389                 $query = 'UPDATE '\r
2390                 .      sql_table('category') . ' '\r
2391                 . 'SET '\r
2392                 . '    cblog = %d' . ' '\r
2393                 . 'WHERE '\r
2394                 . '    catid = %d';\r
2395                 sql_query(sprintf($query, $destblogid, $catid));\r
2396                 $manager->notify(\r
2397                                 'PostMoveCategory',\r
2398                                 array(\r
2399                                                 'catid'      => &$catid,\r
2400                                                 'sourceblog' => &$blog,\r
2401                                                 'destblog'   => $destblog\r
2402                                 )\r
2403                 );\r
2404                 return;\r
2405         }\r
2406 \r
2407         /**\r
2408          * Admin::action_blogsettingsupdate\r
2409          * Updating blog settings\r
2410          * \r
2411          * @param       Void\r
2412          * @return      Void\r
2413          */\r
2414         static private function action_blogsettingsupdate()\r
2415         {\r
2416                 global $member, $manager;\r
2417                 \r
2418                 $blogid = intRequestVar('blogid');\r
2419                 \r
2420                 $member->blogAdminRights($blogid) or self::disallow();\r
2421                 \r
2422                 $blog =& $manager->getBlog($blogid);\r
2423                 \r
2424                 $notify_address = trim(postVar('notify'));\r
2425                 $shortname              = trim(postVar('shortname'));\r
2426                 $updatefile             = trim(postVar('update'));\r
2427                 \r
2428                 $notifyComment  = intPostVar('notifyComment');\r
2429                 $notifyVote             = intPostVar('notifyVote');\r
2430                 $notifyNewItem  = intPostVar('notifyNewItem');\r
2431                 \r
2432                 if ( $notifyComment == 0 )\r
2433                 {\r
2434                         $notifyComment = 1;\r
2435                 }\r
2436                 if ( $notifyVote == 0 )\r
2437                 {\r
2438                         $notifyVote = 1;\r
2439                 }\r
2440                 if ( $notifyNewItem == 0 )\r
2441                 {\r
2442                         $notifyNewItem = 1;\r
2443                 }\r
2444                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;\r
2445                 \r
2446                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )\r
2447                 {\r
2448                         self::error(_ERROR_BADNOTIFY);\r
2449                 }\r
2450                 \r
2451                 if ( !isValidShortName($shortname) )\r
2452                 {\r
2453                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2454                 }\r
2455                 \r
2456                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )\r
2457                 {\r
2458                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2459                 }\r
2460                 // check if update file is writable\r
2461                 if ( $updatefile && !is_writeable($updatefile) )\r
2462                 {\r
2463                         self::error(_ERROR_UPDATEFILE);\r
2464                 }\r
2465                 \r
2466                 $blog->setName(trim(postVar('name')));\r
2467                 $blog->setShortName($shortname);\r
2468                 $blog->setNotifyAddress($notify_address);\r
2469                 $blog->setNotifyType($notifyType);\r
2470                 $blog->setMaxComments(postVar('maxcomments'));\r
2471                 $blog->setCommentsEnabled(postVar('comments'));\r
2472                 $blog->setTimeOffset(postVar('timeoffset'));\r
2473                 $blog->setUpdateFile($updatefile);\r
2474                 $blog->setURL(trim(postVar('url')));\r
2475                 $blog->setDefaultSkin(intPostVar('defskin'));\r
2476                 $blog->setDescription(trim(postVar('desc')));\r
2477                 $blog->setPublic(postVar('public'));\r
2478                 $blog->setConvertBreaks(intPostVar('convertbreaks'));\r
2479                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));\r
2480                 $blog->setDefaultCategory(intPostVar('defcat'));\r
2481                 $blog->setSearchable(intPostVar('searchable'));\r
2482                 $blog->setEmailRequired(intPostVar('reqemail'));\r
2483                 $blog->writeSettings();\r
2484                 \r
2485                 // store plugin options\r
2486                 $aOptions = requestArray('plugoption');\r
2487                 NucleusPlugin::apply_plugin_options($aOptions);\r
2488                 \r
2489                 $data = array(\r
2490                         'context' => 'blog',\r
2491                         'blogid'  => $blogid,\r
2492                         'blog'    => &$blog\r
2493                 );\r
2494                 $manager->notify('PostPluginOptionsUpdate', $data);\r
2495                 \r
2496                 self::action_overview(_MSG_SETTINGSCHANGED);\r
2497                 return;\r
2498         }\r
2499         \r
2500         /**\r
2501          * Admin::action_deleteblog()\r
2502          * \r
2503          * @param       void\r
2504          * @return      void\r
2505          */\r
2506         static private function action_deleteblog()\r
2507         {\r
2508                 global $member, $CONF, $manager;\r
2509                 \r
2510                 $blogid = intRequestVar('blogid');\r
2511                 \r
2512                 $member->blogAdminRights($blogid) or self::disallow();\r
2513                 \r
2514                 // check if blog is default blog\r
2515                 if ( $CONF['DefaultBlog'] == $blogid )\r
2516                 {\r
2517                         self::error(_ERROR_DELDEFBLOG);\r
2518                 }\r
2519                 \r
2520                 $blog =& $manager->getBlog($blogid);\r
2521                 \r
2522                 self::$skin->parse('deleteblog');\r
2523                 return;\r
2524         }\r
2525         \r
2526         /**\r
2527          * Admin::action_deleteblogconfirm()\r
2528          * Delete Blog\r
2529          * \r
2530          * @param       Void\r
2531          * @return      Void\r
2532          */\r
2533         static private function action_deleteblogconfirm()\r
2534         {\r
2535                 global $member, $CONF, $manager;\r
2536                 \r
2537                 $blogid = intRequestVar('blogid');\r
2538                 \r
2539                 $data = array('blogid' => $blogid);\r
2540                 $manager->notify('PreDeleteBlog', $data);\r
2541                 \r
2542                 $member->blogAdminRights($blogid) or self::disallow();\r
2543                 \r
2544                 // check if blog is default blog\r
2545                 if ( $CONF['DefaultBlog'] == $blogid )\r
2546                 {\r
2547                         self::error(_ERROR_DELDEFBLOG);\r
2548                 }\r
2549                 \r
2550                 // delete all comments\r
2551                 $query = 'DELETE FROM ' . sql_table('comment') . ' WHERE cblog='.$blogid;\r
2552                 DB::execute($query);\r
2553                 \r
2554                 // delete all items\r
2555                 $query = 'DELETE FROM ' . sql_table('item') . ' WHERE iblog=' . $blogid;\r
2556                 DB::execute($query);\r
2557                 \r
2558                 // delete all team members\r
2559                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tblog=' . $blogid;\r
2560                 DB::execute($query);\r
2561                 \r
2562                 // delete all bans\r
2563                 $query = 'DELETE FROM ' . sql_table('ban') . ' WHERE blogid=' . $blogid;\r
2564                 DB::execute($query);\r
2565                 \r
2566                 // delete all categories\r
2567                 $query = 'DELETE FROM ' . sql_table('category') . ' WHERE cblog=' . $blogid;\r
2568                 DB::execute($query);\r
2569                 \r
2570                 // delete all associated plugin options\r
2571                 NucleusPlugin::delete_option_values('blog', $blogid);\r
2572                 \r
2573                 // delete the blog itself\r
2574                 $query = 'DELETE FROM ' . sql_table('blog') . ' WHERE bnumber=' . $blogid;\r
2575                 DB::execute($query);\r
2576                 \r
2577                 $data = array('blogid' => $blogid);\r
2578                 $manager->notify('PostDeleteBlog', $data);\r
2579                 \r
2580                 self::action_overview(_DELETED_BLOG);\r
2581                 return;\r
2582         }\r
2583         \r
2584         /**\r
2585          * Admin::action_memberdelete()\r
2586          * \r
2587          * @param       void\r
2588          * @return      void\r
2589          */\r
2590         static private function action_memberdelete()\r
2591         {\r
2592                 global $member, $manager;\r
2593                 \r
2594                 $memberid = intRequestVar('memberid');\r
2595                 \r
2596                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2597                 \r
2598                 $mem =& $manager->getMember($memberid);\r
2599                 \r
2600                 self::$skin->parse('memberdelete');\r
2601                 return;\r
2602         }\r
2603         \r
2604         /**\r
2605          * Admin::action_memberdeleteconfirm()\r
2606          * \r
2607          * @param       void\r
2608          * @return      void\r
2609          */\r
2610         static private function action_memberdeleteconfirm()\r
2611         {\r
2612                 global $member;\r
2613                 \r
2614                 $memberid = intRequestVar('memberid');\r
2615                 \r
2616                 ($member->getID() == $memberid) or $member->isAdmin() or self::disallow();\r
2617                 \r
2618                 $error = self::deleteOneMember($memberid);\r
2619                 if ( $error )\r
2620                 {\r
2621                         self::error($error);\r
2622                 }\r
2623                 \r
2624                 if ( $member->isAdmin() )\r
2625                 {\r
2626                         self::action_usermanagement();\r
2627                 }\r
2628                 else\r
2629                 {\r
2630                         self::action_overview(_DELETED_MEMBER);\r
2631                 }\r
2632                 return;\r
2633         }\r
2634         \r
2635         /**\r
2636          * Admin::deleteOneMember()\r
2637          * Delete a member by id\r
2638          * \r
2639          * @static\r
2640          * @params      Integer $memberid       member id\r
2641          * @return      String  null string or error messages\r
2642          */\r
2643         static public function deleteOneMember($memberid)\r
2644         {\r
2645                 global $manager;\r
2646                 \r
2647                 $memberid = intval($memberid);\r
2648                 $mem =& $manager->getMember($memberid);\r
2649                 \r
2650                 if ( !$mem->canBeDeleted() )\r
2651                 {\r
2652                         return _ERROR_DELETEMEMBER;\r
2653                 }\r
2654                 \r
2655                 $data = array('member' => &$mem);\r
2656                 $manager->notify('PreDeleteMember', $data);\r
2657                 \r
2658                 /* unlink comments from memberid */\r
2659                 if ( $memberid )\r
2660                 {\r
2661                         $query = "UPDATE %s SET cmember=0, cuser=%s WHERE cmember=%d;";\r
2662                         $query = sprintf($query, sql_table('comment'), DB::quoteValue($mem->getDisplayName()), $memberid);\r
2663                         DB::execute($query);\r
2664                 }\r
2665                 \r
2666                 $query = 'DELETE FROM ' . sql_table('member') . ' WHERE mnumber=' . $memberid;\r
2667                 DB::execute($query);\r
2668                 \r
2669                 $query = 'DELETE FROM ' . sql_table('team') . ' WHERE tmember=' . $memberid;\r
2670                 DB::execute($query);\r
2671                 \r
2672                 $query = 'DELETE FROM ' . sql_table('activation') . ' WHERE vmember=' . $memberid;\r
2673                 DB::execute($query);\r
2674                 \r
2675                 // delete all associated plugin options\r
2676                 NucleusPlugin::delete_option_values('member', $memberid);\r
2677                 \r
2678                 $data = array('member' => &$mem);\r
2679                 $manager->notify('PostDeleteMember', $data);\r
2680                 \r
2681                 return '';\r
2682         }\r
2683         \r
2684         /**\r
2685          * Admin::action_createnewlog()\r
2686          * \r
2687          * @param       void\r
2688          * @return      void\r
2689          */\r
2690         static private function action_createnewlog()\r
2691         {\r
2692                 global $member, $CONF, $manager;\r
2693                 \r
2694                 // Only Super-Admins can do this\r
2695                 $member->isAdmin() or self::disallow();\r
2696                 \r
2697                 self::$skin->parse('createnewlog');\r
2698                 return;\r
2699         }\r
2700         \r
2701         /**\r
2702          * Admin::action_addnewlog()\r
2703          * \r
2704          * @param       void\r
2705          * @return      void\r
2706          */\r
2707         static private function action_addnewlog()\r
2708         {\r
2709                 global $member, $manager, $CONF;\r
2710                 \r
2711                 // Only Super-Admins can do this\r
2712                 $member->isAdmin() or self::disallow();\r
2713                 \r
2714                 $bname                  = trim(postVar('name'));\r
2715                 $bshortname             = trim(postVar('shortname'));\r
2716                 $btimeoffset    = postVar('timeoffset');\r
2717                 $bdesc                  = trim(postVar('desc'));\r
2718                 $bdefskin               = postVar('defskin');\r
2719                 \r
2720                 if ( !isValidShortName($bshortname) )\r
2721                 {\r
2722                         self::error(_ERROR_BADSHORTBLOGNAME);\r
2723                 }\r
2724                 \r
2725                 if ( $manager->existsBlog($bshortname) )\r
2726                 {\r
2727                         self::error(_ERROR_DUPSHORTBLOGNAME);\r
2728                 }\r
2729                 \r
2730                 $data = array(\r
2731                         'name'        => &$bname,\r
2732                         'shortname'   => &$bshortname,\r
2733                         'timeoffset'  => &$btimeoffset,\r
2734                         'description' => &$bdesc,\r
2735                         'defaultskin' => &$bdefskin\r
2736                 );\r
2737                 $manager->notify('PreAddBlog', $data);\r
2738                 \r
2739                 // add slashes for sql queries\r
2740                 $bname                  = DB::quoteValue($bname);\r
2741                 $bshortname             = DB::quoteValue($bshortname);\r
2742                 $btimeoffset    = DB::quoteValue($btimeoffset);\r
2743                 $bdesc                  = DB::quoteValue($bdesc);\r
2744                 $bdefskin               = DB::quoteValue($bdefskin);\r
2745                 \r
2746                 // create blog\r
2747                 $query = "INSERT INTO %s (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES (%s, %s, %s, %s, %s);";\r
2748                 $query = sprintf($query, sql_table('blog'), $bname, $bshortname, $bdesc, $btimeoffset, $bdefskin);\r
2749                 DB::execute($query);\r
2750                 \r
2751                 $blogid = DB::getInsertId();\r
2752                 $blog   =& $manager->getBlog($blogid);\r
2753                 \r
2754                 // create new category\r
2755                 $catdefname = (!defined('_EBLOGDEFAULTCATEGORY_NAME') ? 'General' : _EBLOGDEFAULTCATEGORY_NAME);\r
2756                 $catdefdesc = (!defined('_EBLOGDEFAULTCATEGORY_DESC') ? 'Items that do not fit in other categories' : _EBLOGDEFAULTCATEGORY_DESC);\r
2757                 \r
2758                 $query = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, %s, %s)';\r
2759                 DB::execute(sprintf($query, sql_table('category'), (integer) $blogid, DB::quoteValue($catdefname), DB::quoteValue($catdefdesc)));\r
2760                 $catid = DB::getInsertId();\r
2761                 \r
2762                 // set as default category\r
2763                 $blog->setDefaultCategory($catid);\r
2764                 $blog->writeSettings();\r
2765                 \r
2766                 // create team member\r
2767                 $query = "INSERT INTO %s (tmember, tblog, tadmin) VALUES (%d, %d, 1);";\r
2768                 $query = sprintf($query, sql_table('team'), (integer) $member->getID(), (integer) $blogid);\r
2769                 DB::execute($query);\r
2770                 \r
2771                 $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');\r
2772                 $itemdefbody  = (defined('_EBLOG_FIRSTITEM_BODY')  ? _EBLOG_FIRSTITEM_BODY  : 'This is the first item in your weblog. Feel free to delete it.');\r
2773                 \r
2774                 $blog->additem(\r
2775                         $blog->getDefaultCategory(),\r
2776                         $itemdeftitle,$itemdefbody,\r
2777                         '',\r
2778                         $blogid,\r
2779                         $member->getID(),\r
2780                         $blog->getCorrectTime(),\r
2781                         0,\r
2782                         0,\r
2783                         0\r
2784                 );\r
2785                 \r
2786                 $data = array('blog' => &$blog);\r
2787                 $manager->notify('PostAddBlog', $data);\r
2788                 \r
2789                 $data = array(\r
2790                         'blog'                  => &$blog,\r
2791                         'name'                  => _EBLOGDEFAULTCATEGORY_NAME,\r
2792                         'description'   => _EBLOGDEFAULTCATEGORY_DESC,\r
2793                         'catid'                 => $catid\r
2794                 );\r
2795                 $manager->notify('PostAddCategory', $data);\r
2796                 \r
2797                 /* TODO: we should consider to use the other way insterad of this */\r
2798                 $_REQUEST['blogid'] = $blogid;\r
2799                 $_REQUEST['catid']  = $catid;\r
2800                 self::$skin->parse('addnewlog');\r
2801                 return;\r
2802         }\r
2803         \r
2804         /**\r
2805          * Admin::action_addnewlog2()\r
2806          * \r
2807          * @param       void\r
2808          * @return      void\r
2809          */\r
2810         static private function action_addnewlog2()\r
2811         {\r
2812                 global $member, $manager;\r
2813                 $blogid = intRequestVar('blogid');\r
2814                 \r
2815                 $member->blogAdminRights($blogid) or self::disallow();\r
2816                 \r
2817                 $burl = requestVar('url');\r
2818                 \r
2819                 $blog =& $manager->getBlog($blogid);\r
2820                 $blog->setURL(trim($burl));\r
2821                 $blog->writeSettings();\r
2822                 \r
2823                 self::action_overview(_MSG_NEWBLOG);\r
2824                 return;\r
2825         }\r
2826         \r
2827         /**\r
2828          * Admin::action_skinieoverview()\r
2829          * \r
2830          * @param       void\r
2831          * @return      void\r
2832          */\r
2833         static private function action_skinieoverview()\r
2834         {\r
2835                 global $member, $DIR_LIBS, $manager;\r
2836                 \r
2837                 $member->isAdmin() or self::disallow();\r
2838                 \r
2839                 include_once($DIR_LIBS . 'skinie.php');\r
2840                 \r
2841                 self::$skin->parse('skinieoverview');\r
2842                 return;\r
2843         }\r
2844         \r
2845         /**\r
2846          * Admin::action_skinieimport()\r
2847          * \r
2848          * @param       void\r
2849          * @return      void\r
2850          */\r
2851         static private function action_skinieimport()\r
2852         {\r
2853                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;\r
2854                 \r
2855                 $member->isAdmin() or self::disallow();\r
2856                 \r
2857                 // load skinie class\r
2858                 include_once($DIR_LIBS . 'skinie.php');\r
2859                 \r
2860                 $skinFileRaw    = postVar('skinfile');\r
2861                 $mode                   = postVar('mode');\r
2862                 \r
2863                 $importer = new SkinImport();\r
2864                 \r
2865                 // get full filename\r
2866                 if ( $mode == 'file' )\r
2867                 {\r
2868                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2869                         \r
2870                         /* TODO: remove this\r
2871                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2872                         if ( !file_exists($skinFile) )\r
2873                         {\r
2874                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2875                         }\r
2876                          */\r
2877                 }\r
2878                 else\r
2879                 {\r
2880                         $skinFile = $skinFileRaw;\r
2881                 }\r
2882                 \r
2883                 // read only metadata\r
2884                 $error = $importer->readFile($skinFile, 1);\r
2885                 \r
2886                 /* TODO: we should consider to use the other way insterad of this */\r
2887                 $_REQUEST['skininfo']   = $importer->getInfo();\r
2888                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
2889                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
2890                 \r
2891                 // clashes\r
2892                 $skinNameClashes                = $importer->checkSkinNameClashes();\r
2893                 $templateNameClashes    = $importer->checkTemplateNameClashes();\r
2894                 $hasNameClashes                 = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
2895                 \r
2896                 /* TODO: we should consider to use the other way insterad of this */\r
2897                 $_REQUEST['skinclashes'] = $skinNameClashes;\r
2898                 $_REQUEST['tpltclashes'] = $templateNameClashes;\r
2899                 $_REQUEST['nameclashes'] = $hasNameClashes ? 1 : 0;\r
2900                 \r
2901                 if ( $error )\r
2902                 {\r
2903                         self::error($error);\r
2904                 }\r
2905                 \r
2906                 self::$skin->parse('skinieimport');\r
2907                 return;\r
2908         }\r
2909         \r
2910         /**\r
2911          * Admin::action_skiniedoimport()\r
2912          * \r
2913          * @param       void\r
2914          * @return      void\r
2915          */\r
2916         static private function action_skiniedoimport()\r
2917         {\r
2918                 global $member, $DIR_LIBS, $DIR_SKINS;\r
2919                 \r
2920                 $member->isAdmin() or self::disallow();\r
2921                 \r
2922                 // load skinie class\r
2923                 include_once($DIR_LIBS . 'skinie.php');\r
2924                 \r
2925                 $skinFileRaw    = postVar('skinfile');\r
2926                 $mode                   = postVar('mode');\r
2927                 \r
2928                 $allowOverwrite = intPostVar('overwrite');\r
2929                 \r
2930                 // get full filename\r
2931                 if ( $mode == 'file' )\r
2932                 {\r
2933                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';\r
2934                         \r
2935                         /* TODO: remove this\r
2936                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
2937                         if ( !file_exists($skinFile) )\r
2938                         {\r
2939                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';\r
2940                         }\r
2941                         */\r
2942                 }\r
2943                 else\r
2944                 {\r
2945                         $skinFile = $skinFileRaw;\r
2946                 }\r
2947                 \r
2948                 $importer = new SkinImport();\r
2949                 \r
2950                 $error = $importer->readFile($skinFile);\r
2951                 \r
2952                 if ( $error )\r
2953                 {\r
2954                         self::error($error);\r
2955                 }\r
2956                 \r
2957                 $error = $importer->writeToDatabase($allowOverwrite);\r
2958                 \r
2959                 if ( $error )\r
2960                 {\r
2961                         self::error($error);\r
2962                 }\r
2963                 \r
2964                 /* TODO: we should consider to use the other way insterad of this */\r
2965                 $_REQUEST['skininfo']  = $importer->getInfo();\r
2966                 $_REQUEST['skinnames'] = $importer->getSkinNames();\r
2967                 $_REQUEST['tpltnames'] = $importer->getTemplateNames();\r
2968                 \r
2969                 self::$skin->parse('skiniedoimport');\r
2970                 return;\r
2971         }\r
2972 \r
2973         /**\r
2974          * Admin::action_skinieexport()\r
2975          * \r
2976          * @param       void\r
2977          * @return      void\r
2978          */\r
2979         static private function action_skinieexport()\r
2980         {\r
2981                 global $member, $DIR_LIBS;\r
2982                 \r
2983                 $member->isAdmin() or self::disallow();\r
2984                 \r
2985                 // load skinie class\r
2986                 include_once($DIR_LIBS . 'skinie.php');\r
2987                 \r
2988                 $aSkins         = requestIntArray('skin');\r
2989                 $aTemplates     = requestIntArray('template');\r
2990                 \r
2991                 if ( !is_array($aTemplates) )\r
2992                 {\r
2993                         $aTemplates = array();\r
2994                 }\r
2995                 if ( !is_array($aSkins) )\r
2996                 {\r
2997                         $aSkins = array();\r
2998                 }\r
2999                 \r
3000                 $skinList               = array_keys($aSkins);\r
3001                 $templateList   = array_keys($aTemplates);\r
3002                 \r
3003                 $info = postVar('info');\r
3004                 \r
3005                 $exporter = new SkinExport();\r
3006                 foreach ( $skinList as $skinId )\r
3007                 {\r
3008                         $exporter->addSkin($skinId);\r
3009                 }\r
3010                 foreach ($templateList as $templateId)\r
3011                 {\r
3012                         $exporter->addTemplate($templateId);\r
3013                 }\r
3014                 $exporter->setInfo($info);\r
3015                 \r
3016                 $exporter->export();\r
3017                 return;\r
3018         }\r
3019         \r
3020         /**\r
3021          * Admin::action_templateoverview()\r
3022          * \r
3023          * @param       void\r
3024          * @return      void\r
3025          */\r
3026         static private function action_templateoverview()\r
3027         {\r
3028                 global $member, $manager;\r
3029                 \r
3030                 $member->isAdmin() or self::disallow();\r
3031                 \r
3032                 self::$skin->parse('templateoverview');\r
3033                 return;\r
3034         }\r
3035         \r
3036         /**\r
3037          * Admin::action_templateedit()\r
3038          * \r
3039          * @param       string  $msg    message for pageheader\r
3040          * @return      void\r
3041          */\r
3042         static private function action_templateedit($msg = '')\r
3043         {\r
3044                 global $member, $manager;\r
3045                 if ( $msg )\r
3046                 {\r
3047                         self::$headMess = $msg;\r
3048                 }\r
3049                 \r
3050                 $templateid = intRequestVar('templateid');\r
3051                 \r
3052                 $member->isAdmin() or self::disallow();\r
3053                 \r
3054                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3055                 Admin::$extrahead .= "<script type=\"text/javascript\">setTemplateEditText('" . Entity::hsc(_EDITTEMPLATE_EMPTY) . "');</script>\n";\r
3056                 \r
3057                 self::$skin->parse('templateedit');\r
3058                 return;\r
3059         }\r
3060         \r
3061         /**\r
3062          * Admin::action_templateupdate()\r
3063          * \r
3064          * @param       void\r
3065          * @return      void\r
3066          */\r
3067         static private function action_templateupdate()\r
3068         {\r
3069                 global $member,$manager;\r
3070                 \r
3071                 $templateid = intRequestVar('templateid');\r
3072                 \r
3073                 $member->isAdmin() or self::disallow();\r
3074                 \r
3075                 $name = postVar('tname');\r
3076                 $desc = postVar('tdesc');\r
3077                 \r
3078                 if ( !isValidTemplateName($name) )\r
3079                 {\r
3080                         self::error(_ERROR_BADTEMPLATENAME);\r
3081                 }\r
3082                 \r
3083                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3084                 {\r
3085                         self::error(_ERROR_DUPTEMPLATENAME);\r
3086                 }\r
3087                 \r
3088                 // 1. Remove all template parts\r
3089                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3090                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3091                 DB::execute($query);\r
3092                 \r
3093                 // 2. Update description\r
3094                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3095                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3096                 DB::execute($query);\r
3097                 \r
3098                 // 3. Add non-empty template parts\r
3099                 self::addToTemplate($templateid, 'ITEM_HEADER',                 postVar('ITEM_HEADER'));\r
3100                 self::addToTemplate($templateid, 'ITEM',                                postVar('ITEM'));\r
3101                 self::addToTemplate($templateid, 'ITEM_FOOTER',                 postVar('ITEM_FOOTER'));\r
3102                 self::addToTemplate($templateid, 'MORELINK',                    postVar('MORELINK'));\r
3103                 self::addToTemplate($templateid, 'EDITLINK',                    postVar('EDITLINK'));\r
3104                 self::addToTemplate($templateid, 'NEW',                                 postVar('NEW'));\r
3105                 self::addToTemplate($templateid, 'COMMENTS_HEADER',             postVar('COMMENTS_HEADER'));\r
3106                 self::addToTemplate($templateid, 'COMMENTS_BODY',               postVar('COMMENTS_BODY'));\r
3107                 self::addToTemplate($templateid, 'COMMENTS_FOOTER',             postVar('COMMENTS_FOOTER'));\r
3108                 self::addToTemplate($templateid, 'COMMENTS_CONTINUED',  postVar('COMMENTS_CONTINUED'));\r
3109                 self::addToTemplate($templateid, 'COMMENTS_TOOMUCH',    postVar('COMMENTS_TOOMUCH'));\r
3110                 self::addToTemplate($templateid, 'COMMENTS_AUTH',               postVar('COMMENTS_AUTH'));\r
3111                 self::addToTemplate($templateid, 'COMMENTS_ONE',                postVar('COMMENTS_ONE'));\r
3112                 self::addToTemplate($templateid, 'COMMENTS_MANY',               postVar('COMMENTS_MANY'));\r
3113                 self::addToTemplate($templateid, 'COMMENTS_NONE',               postVar('COMMENTS_NONE'));\r
3114                 self::addToTemplate($templateid, 'ARCHIVELIST_HEADER',  postVar('ARCHIVELIST_HEADER'));\r
3115                 self::addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));\r
3116                 self::addToTemplate($templateid, 'ARCHIVELIST_FOOTER',  postVar('ARCHIVELIST_FOOTER'));\r
3117                 self::addToTemplate($templateid, 'BLOGLIST_HEADER',             postVar('BLOGLIST_HEADER'));\r
3118                 self::addToTemplate($templateid, 'BLOGLIST_LISTITEM',   postVar('BLOGLIST_LISTITEM'));\r
3119                 self::addToTemplate($templateid, 'BLOGLIST_FOOTER',             postVar('BLOGLIST_FOOTER'));\r
3120                 self::addToTemplate($templateid, 'CATLIST_HEADER',              postVar('CATLIST_HEADER'));\r
3121                 self::addToTemplate($templateid, 'CATLIST_LISTITEM',    postVar('CATLIST_LISTITEM'));\r
3122                 self::addToTemplate($templateid, 'CATLIST_FOOTER',              postVar('CATLIST_FOOTER'));\r
3123                 self::addToTemplate($templateid, 'DATE_HEADER',                 postVar('DATE_HEADER'));\r
3124                 self::addToTemplate($templateid, 'DATE_FOOTER',                 postVar('DATE_FOOTER'));\r
3125                 self::addToTemplate($templateid, 'FORMAT_DATE',                 postVar('FORMAT_DATE'));\r
3126                 self::addToTemplate($templateid, 'FORMAT_TIME',                 postVar('FORMAT_TIME'));\r
3127                 self::addToTemplate($templateid, 'LOCALE',                              postVar('LOCALE'));\r
3128                 self::addToTemplate($templateid, 'SEARCH_HIGHLIGHT',    postVar('SEARCH_HIGHLIGHT'));\r
3129                 self::addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));\r
3130                 self::addToTemplate($templateid, 'POPUP_CODE',                  postVar('POPUP_CODE'));\r
3131                 self::addToTemplate($templateid, 'MEDIA_CODE',                  postVar('MEDIA_CODE'));\r
3132                 self::addToTemplate($templateid, 'IMAGE_CODE',                  postVar('IMAGE_CODE'));\r
3133                 \r
3134                 $data = array('fields' => array());\r
3135                 $manager->notify('TemplateExtraFields', $data);\r
3136                 foreach ( $data['fields'] as $pfkey=>$pfvalue )\r
3137                 {\r
3138                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3139                         {\r
3140                                 self::addToTemplate($templateid, $pffield, postVar($pffield));\r
3141                         }\r
3142                 }\r
3143                 \r
3144                 // jump back to template edit\r
3145                 self::action_templateedit(_TEMPLATE_UPDATED);\r
3146                 return;\r
3147         }\r
3148         \r
3149         /**\r
3150          * Admin::addToTemplate()\r
3151          * \r
3152          * @param       Integer $id     ID for template\r
3153          * @param       String  $partname       parts name\r
3154          * @param       String  $content        template contents\r
3155          * @return      Integer record index\r
3156          * \r
3157          */\r
3158         static private function addToTemplate($id, $partname, $content)\r
3159         {\r
3160                 // don't add empty parts:\r
3161                 if ( !trim($content) )\r
3162                 {\r
3163                         return -1;\r
3164                 }\r
3165                 \r
3166                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent) VALUES (%d, %s, %s);";\r
3167                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3168                 if ( DB::execute($query) === FALSE )\r
3169                 {\r
3170                         $err = DB::getError();\r
3171                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3172                 }\r
3173                 return DB::getInsertId();\r
3174         }\r
3175         \r
3176         /**\r
3177          * Admin::action_templatedelete()\r
3178          * \r
3179          * @param       void\r
3180          * @return      void\r
3181          */\r
3182         static private function action_templatedelete()\r
3183         {\r
3184                 global $member, $manager;\r
3185                 \r
3186                 $member->isAdmin() or self::disallow();\r
3187                 \r
3188                 $templateid = intRequestVar('templateid');\r
3189                 // TODO: check if template can be deleted\r
3190                 \r
3191                 self::$skin->parse('templatedelete');\r
3192                 return;\r
3193         }\r
3194         \r
3195         /**\r
3196          * Admin::action_templatedeleteconfirm()\r
3197          * \r
3198          * @param       void\r
3199          * @return      void\r
3200          */\r
3201         static private function action_templatedeleteconfirm()\r
3202         {\r
3203                 global $member, $manager;\r
3204                 \r
3205                 $templateid = intRequestVar('templateid');\r
3206                 \r
3207                 $member->isAdmin() or self::disallow();\r
3208                 \r
3209                 $data = array('templateid' => $templateid);\r
3210                 $manager->notify('PreDeleteTemplate', $data);\r
3211                 \r
3212                 // 1. delete description\r
3213                 DB::execute('DELETE FROM ' . sql_table('template_desc') . ' WHERE tdnumber=' . $templateid);\r
3214                 \r
3215                 // 2. delete parts\r
3216                 DB::execute('DELETE FROM ' . sql_table('template') . ' WHERE tdesc=' . $templateid);\r
3217                 \r
3218                 \r
3219                 $data = array('templateid' => $templateid);\r
3220                 $manager->notify('PostDeleteTemplate', $data);\r
3221                 \r
3222                 self::action_templateoverview();\r
3223                 return;\r
3224         }\r
3225         \r
3226         /**\r
3227          * Admin::action_templatenew()\r
3228          * \r
3229          * @param       void\r
3230          * @return      void\r
3231          */\r
3232         static private function action_templatenew()\r
3233         {\r
3234                 global $member;\r
3235                 \r
3236                 $member->isAdmin() or self::disallow();\r
3237                 \r
3238                 $name = postVar('name');\r
3239                 $desc = postVar('desc');\r
3240                 \r
3241                 if ( !isValidTemplateName($name) )\r
3242                 {\r
3243                         self::error(_ERROR_BADTEMPLATENAME);\r
3244                 }\r
3245                 \r
3246                 if ( Template::exists($name) )\r
3247                 {\r
3248                         self::error(_ERROR_DUPTEMPLATENAME);\r
3249                 }\r
3250                 \r
3251                 $newTemplateId = Template::createNew($name, $desc);\r
3252                 \r
3253                 self::action_templateoverview();\r
3254                 return;\r
3255         }\r
3256         \r
3257         /**\r
3258          * Admin::action_templateclone()\r
3259          * \r
3260          * @param       void\r
3261          * @return      void\r
3262          */\r
3263         static private function action_templateclone()\r
3264         {\r
3265                 global $member;\r
3266                 \r
3267                 $templateid = intRequestVar('templateid');\r
3268                 \r
3269                 $member->isAdmin() or self::disallow();\r
3270                 \r
3271                 // 1. read old template\r
3272                 $name = Template::getNameFromId($templateid);\r
3273                 $desc = Template::getDesc($templateid);\r
3274                 \r
3275                 // 2. create desc thing\r
3276                 $name = "cloned" . $name;\r
3277                 \r
3278                 // if a template with that name already exists:\r
3279                 if ( Template::exists($name) )\r
3280                 {\r
3281                         $i = 1;\r
3282                         while (Template::exists($name . $i))\r
3283                         {\r
3284                                 $i++;\r
3285                         }\r
3286                         $name .= $i;\r
3287                 }\r
3288                 \r
3289                 $newid = Template::createNew($name, $desc);\r
3290                 \r
3291                 // 3. create clone\r
3292                 // go through parts of old template and add them to the new one\r
3293                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3294                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3295                 \r
3296                 $res = DB::getResult($query);\r
3297                 foreach ( $res as $row)\r
3298                 {\r
3299                         self::addToTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3300                 }\r
3301                 \r
3302                 self::action_templateoverview();\r
3303                 return;\r
3304         }\r
3305         \r
3306         /**\r
3307          * Admin::action_admintemplateoverview()\r
3308          * \r
3309          * @param       void\r
3310          * @return      void\r
3311          */\r
3312         static private function action_admintemplateoverview()\r
3313         {\r
3314                 global $member;\r
3315                 $member->isAdmin() or self::disallow();\r
3316                 self::$skin->parse('admntemplateoverview');\r
3317                 return;\r
3318         }\r
3319         \r
3320         /**\r
3321          * Admin::action_admintemplateedit()\r
3322          * \r
3323          * @param       string  $msg    message for pageheader\r
3324          * @return      void\r
3325          */\r
3326         static private function action_admintemplateedit($msg = '')\r
3327         {\r
3328                 global $member, $manager;\r
3329                 if ( $msg )\r
3330                 {\r
3331                         self::$headMess = $msg;\r
3332                 }\r
3333                 $member->isAdmin() or self::disallow();\r
3334                 \r
3335                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/templateEdit.js\"></script>\n";\r
3336                 Admin::$extrahead .= '<script type="text/javascript">setTemplateEditText("' . Entity::hsc(_EDITTEMPLATE_EMPTY) . '");</script>' . "\n";\r
3337                 \r
3338                 self::$skin->parse('admintemplateedit');\r
3339                 return;\r
3340         }\r
3341         \r
3342         /**\r
3343          * Admin::action_admintemplateupdate()\r
3344          * \r
3345          * @param       void\r
3346          * @return      void\r
3347          */\r
3348         static private function action_admintemplateupdate()\r
3349         {\r
3350                 global $member, $manager;\r
3351                 $templateid = intRequestVar('templateid');\r
3352                 $member->isAdmin() or self::disallow();\r
3353                 $name = postVar('tname');\r
3354                 $desc = postVar('tdesc');\r
3355                 \r
3356                 if ( !isValidTemplateName($name) )\r
3357                 {\r
3358                         self::error(_ERROR_BADTEMPLATENAME);\r
3359                 }\r
3360                 \r
3361                 if ( (Template::getNameFromId($templateid) != $name) && Template::exists($name) )\r
3362                 {\r
3363                         self::error(_ERROR_DUPTEMPLATENAME);\r
3364                 }\r
3365                 \r
3366                 // 1. Remove all template parts\r
3367                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3368                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3369                 DB::execute($query);\r
3370                 \r
3371                 // 2. Update description\r
3372                 $query = "UPDATE %s SET tdname=%s, tddesc=%s WHERE tdnumber=%d;";\r
3373                 $query = sprintf($query, sql_table('template_desc'), DB::quoteValue($name), DB::quoteValue($desc), (integer) $templateid);\r
3374                 DB::execute($query);\r
3375                 \r
3376                 // 3. Add non-empty template parts\r
3377                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_HEAD',                                    postVar('NORMALSKINLIST_HEAD'));\r
3378                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_BODY',                                    postVar('NORMALSKINLIST_BODY'));\r
3379                 self::addToAdminTemplate($templateid, 'NORMALSKINLIST_FOOT',                                    postVar('NORMALSKINLIST_FOOT'));\r
3380                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ICON',                              postVar('ADMIN_CUSTOMHELPLINK_ICON'));\r
3381                 self::addToAdminTemplate($templateid, 'ADMIN_CUSTOMHELPLINK_ANCHOR',                    postVar('ADMIN_CUSTOMHELPLINK_ANCHOR'));\r
3382                 self::addToAdminTemplate($templateid, 'ADMIN_BLOGLINK',                                                 postVar('ADMIN_BLOGLINK'));\r
3383                 self::addToAdminTemplate($templateid, 'ADMIN_BATCHLIST',                                                postVar('ADMIN_BATCHLIST'));\r
3384                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TITLE',                                  postVar('ACTIVATE_FORGOT_TITLE'));\r
3385                 self::addToAdminTemplate($templateid, 'ACTIVATE_FORGOT_TEXT',                                   postVar('ACTIVATE_FORGOT_TEXT'));\r
3386                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TITLE',                                postVar('ACTIVATE_REGISTER_TITLE'));\r
3387                 self::addToAdminTemplate($templateid, 'ACTIVATE_REGISTER_TEXT',                                 postVar('ACTIVATE_REGISTER_TEXT'));\r
3388                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TITLE',                                  postVar('ACTIVATE_CHANGE_TITLE'));\r
3389                 self::addToAdminTemplate($templateid, 'ACTIVATE_CHANGE_TEXT',                                   postVar('ACTIVATE_CHANGE_TEXT'));\r
3390                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_EXPLUGNAME',                               postVar('TEMPLATE_EDIT_EXPLUGNAME'));\r
3391                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_HEAD',                                 postVar('TEMPLATE_EDIT_ROW_HEAD'));\r
3392                 self::addToAdminTemplate($templateid, 'TEMPLATE_EDIT_ROW_TAIL',                                 postVar('TEMPLATE_EDIT_ROW_TAIL'));\r
3393                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_HEAD',                                   postVar('SPECIALSKINLIST_HEAD'));\r
3394                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_BODY',                                   postVar('SPECIALSKINLIST_BODY'));\r
3395                 self::addToAdminTemplate($templateid, 'SPECIALSKINLIST_FOOT',                                   postVar('SPECIALSKINLIST_FOOT'));\r
3396                 self::addToAdminTemplate($templateid, 'SYSTEMINFO_GDSETTINGS',                                  postVar('SYSTEMINFO_GDSETTINGS'));\r
3397                 self::addToAdminTemplate($templateid, 'BANLIST_DELETED_LIST',                                   postVar('BANLIST_DELETED_LIST'));\r
3398                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_TITLE',                                postVar('INSERT_PLUGOPTION_TITLE'));\r
3399                 self::addToAdminTemplate($templateid, 'INSERT_PLUGOPTION_BODY',                                 postVar('INSERT_PLUGOPTION_BODY'));\r
3400                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_ADMIN',                              postVar('INPUTYESNO_TEMPLATE_ADMIN'));\r
3401                 self::addToAdminTemplate($templateid, 'INPUTYESNO_TEMPLATE_NORMAL',                             postVar('INPUTYESNO_TEMPLATE_NORMAL'));\r
3402                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_HEAD',                             postVar('ADMIN_SPECIALSKINLIST_HEAD'));\r
3403                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_BODY',                             postVar('ADMIN_SPECIALSKINLIST_BODY'));\r
3404                 self::addToAdminTemplate($templateid, 'ADMIN_SPECIALSKINLIST_FOOT',                             postVar('ADMIN_SPECIALSKINLIST_FOOT'));\r
3405                 self::addToAdminTemplate($templateid, 'SKINIE_EXPORT_LIST',                                             postVar('SKINIE_EXPORT_LIST'));\r
3406                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_HEAD',                  postVar('SHOWLIST_LISTPLUG_SELECT_HEAD'));\r
3407                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_BODY',                  postVar('SHOWLIST_LISTPLUG_SELECT_BODY'));\r
3408                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_SELECT_FOOT',                  postVar('SHOWLIST_LISTPLUG_SELECT_FOOT'));\r
3409                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_HEAD',                   postVar('SHOWLIST_LISTPLUG_TABLE_HEAD'));\r
3410                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BODY',                   postVar('SHOWLIST_LISTPLUG_TABLE_BODY'));\r
3411                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_FOOT',                   postVar('SHOWLIST_LISTPLUG_TABLE_FOOT'));\r
3412                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_HEAD'));\r
3413                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_BODY'));\r
3414                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_MEMBLIST_FOOT'));\r
3415                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_HEAD'));\r
3416                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_BODY'));\r
3417                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TEAMLIST_FOOT'));\r
3418                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HEAD'));\r
3419                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_BODY'));\r
3420                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_GURL'));\r
3421                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGEVENTLIST'));\r
3422                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGNEDUPDATE'));\r
3423                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPEND'));\r
3424                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGIN_DEPREQ'));\r
3425                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLISTFALSE'));\r
3426                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ACTN'));\r
3427                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_ADMN'));\r
3428                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_HELP'));\r
3429                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTSETURL'));\r
3430                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGLIST_FOOT'));\r
3431                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_HEAD'));\r
3432                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_BODY'));\r
3433                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OYESNO'));\r
3434                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OPWORD'));\r
3435                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEP'));\r
3436                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEO'));\r
3437                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OSELEC'));\r
3438                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OTAREA'));\r
3439                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLGOPT_OITEXT'));\r
3440                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_PLUGOPTN_FOOT'));\r
3441                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_POPTLIST_FOOT'));\r
3442                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_HEAD'));\r
3443                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_BODY'));\r
3444                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ITEMLIST_FOOT'));\r
3445                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_HEAD'));\r
3446                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_BODY'));\r
3447                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_ABAN'));\r
3448                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CMNTLIST_FOOT'));\r
3449                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_HEAD'));\r
3450                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_BODY'));\r
3451                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_TADM'));\r
3452                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM',  postVar('SHOWLIST_LISTPLUG_TABLE_BLIST_BD_SADM'));\r
3453                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGLIST_FOOT'));\r
3454                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_HEAD'));\r
3455                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_BODY'));\r
3456                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_BLOGSNAM_FOOT'));\r
3457                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_HEAD'));\r
3458                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_BODY'));\r
3459                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SHORTNAM_FOOT'));\r
3460                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_HEAD'));\r
3461                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_BODY'));\r
3462                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_CATELIST_FOOT'));\r
3463                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_HEAD'));\r
3464                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_BODY'));\r
3465                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_TPLTLIST_FOOT'));\r
3466                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_HEAD'));\r
3467                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_BODY'));\r
3468                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_SKINLIST_FOOT'));\r
3469                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_HEAD'));\r
3470                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_BODY'));\r
3471                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_DRFTLIST_FOOT'));\r
3472                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_HEAD'));\r
3473                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_BODY'));\r
3474                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_ACTNLIST_FOOT'));\r
3475                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_HEAD'));\r
3476                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_BODY'));\r
3477                 self::addToAdminTemplate($templateid, 'SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT',  postVar('SHOWLIST_LISTPLUG_TABLE_IBANLIST_FOOT'));\r
3478                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_TITLE',                                 postVar('PLUGIN_QUICKMENU_TITLE'));\r
3479                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_HEAD',                                  postVar('PLUGIN_QUICKMENU_HEAD'));\r
3480                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_BODY',                                  postVar('PLUGIN_QUICKMENU_BODY'));\r
3481                 self::addToAdminTemplate($templateid, 'PLUGIN_QUICKMENU_FOOT',                                  postVar('PLUGIN_QUICKMENU_FOOT'));\r
3482                 \r
3483                 $data = array('fields' => array());\r
3484                 $manager->notify('AdminTemplateExtraFields', $data);\r
3485                 foreach ( $data['fields'] as $pfkey => $pfvalue )\r
3486                 {\r
3487                         foreach ( $pfvalue as $pffield => $pfdesc )\r
3488                         {\r
3489                                 self::addToAdminTemplate($templateid, $pffield, postVar($pffield));\r
3490                         }\r
3491                 }\r
3492                 \r
3493                 // jump back to template edit\r
3494                 self::action_admintemplateedit(_TEMPLATE_UPDATED);\r
3495                 return;\r
3496         }\r
3497         \r
3498         /**\r
3499          * Admin::addToAdminTemplate()\r
3500          * \r
3501          * @param       integer $id                     ID for template\r
3502          * @param       string  $partname       name of part for template\r
3503          * @param       void    $contents       content for part of template\r
3504          * @return      integer ID for newly inserted Template\r
3505          */\r
3506         static private function addToAdminTemplate($id, $partname, $content)\r
3507         {\r
3508                 // don't add empty parts:\r
3509                 if ( !trim($content) )\r
3510                 {\r
3511                         return -1;\r
3512                 }\r
3513                 \r
3514                 $query = "INSERT INTO %s (tdesc, tpartname, tcontent ) VALUES (%d, %s, %s);";\r
3515                 $query = sprintf($query, sql_table('template'), (integer) $id, DB::quoteValue($partname), DB::quoteValue($content));\r
3516                 if ( DB::execute($query) === FALSE )\r
3517                 {\r
3518                         $err = DB::getError();\r
3519                         exit(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
3520                 }\r
3521                 return DB::getInsertId();\r
3522         }\r
3523         \r
3524         /**\r
3525          * Admin::action_admintemplatedelete()\r
3526          * \r
3527          * @param       void\r
3528          * @return      void\r
3529          */\r
3530         static private function action_admintemplatedelete()\r
3531         {\r
3532                 global $member, $manager;\r
3533                 $member->isAdmin() or self::disallow();\r
3534                 \r
3535                 // TODO: check if template can be deleted\r
3536                 self::$skin->parse('admintemplatedelete');\r
3537                 return;\r
3538         }\r
3539         \r
3540         /**\r
3541          * Admin::action_admintemplatedeleteconfirm()\r
3542          * \r
3543          * @param       void\r
3544          * @return      void\r
3545          */\r
3546         static private function action_admintemplatedeleteconfirm()\r
3547         {\r
3548                 global $member, $manager;\r
3549                 \r
3550                 $templateid = intRequestVar('templateid');\r
3551                 $member->isAdmin() or self::disallow();\r
3552                 \r
3553                 $data = array('templateid' => $templateid);\r
3554                 $manager->notify('PreDeleteAdminTemplate', $data);\r
3555                 \r
3556                 // 1. delete description\r
3557                 $query = "DELETE FROM %s WHERE tdnumber=%s;";\r
3558                 $query = sprintf($query, sql_table('template_desc'), (integer) $templateid);\r
3559                 DB::execute($query);\r
3560                 \r
3561                 // 2. delete parts\r
3562                 $query = "DELETE FROM %s WHERE tdesc=%d;";\r
3563                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3564                 DB::execute($query);\r
3565                 \r
3566                 $data = array('templateid' => $templateid);\r
3567                 $manager->notify('PostDeleteAdminTemplate', $data);\r
3568                 \r
3569                 self::action_admintemplateoverview();\r
3570                 return;\r
3571         }\r
3572         \r
3573         /**\r
3574          * Admin::action_admintemplatenew()\r
3575          * \r
3576          * @param       void\r
3577          * @return      void\r
3578          */\r
3579         static private function action_admintemplatenew()\r
3580         {\r
3581                 global $member;\r
3582                 $member->isAdmin() or self::disallow();\r
3583                 $name = postVar('name');\r
3584                 $desc = postVar('desc');\r
3585                 \r
3586                 if ( !isValidTemplateName($name) )\r
3587                 {\r
3588                         self::error(_ERROR_BADTEMPLATENAME);\r
3589                 }\r
3590                 else if ( !preg_match('#^admin/#', $name) )\r
3591                 {\r
3592                         self::error(_ERROR_BADADMINTEMPLATENAME);\r
3593                 }\r
3594                 else if ( Template::exists($name) )\r
3595                 {\r
3596                         self::error(_ERROR_DUPTEMPLATENAME);\r
3597                 }\r
3598                 \r
3599                 $newTemplateId = Template::createNew($name, $desc);\r
3600                 self::action_admintemplateoverview();\r
3601                 return;\r
3602         }\r
3603         \r
3604         /**\r
3605          * Admin::action_admintemplateclone()\r
3606          * \r
3607          * @param       void\r
3608          * @return      void\r
3609          */\r
3610         static private function action_admintemplateclone()\r
3611         {\r
3612                 global $member;\r
3613                 $templateid = intRequestVar('templateid');\r
3614                 $member->isAdmin() or self::disallow();\r
3615                 \r
3616                 // 1. read old template\r
3617                 $name = Template::getNameFromId($templateid);\r
3618                 $desc = Template::getDesc($templateid);\r
3619                 \r
3620                 // 2. create desc thing\r
3621                 $name = $name . "cloned";\r
3622                 \r
3623                 // if a template with that name already exists:\r
3624                 if ( Template::exists($name) )\r
3625                 {\r
3626                         $i = 1;\r
3627                         while ( Template::exists($name . $i) )\r
3628                         {\r
3629                                 $i++;\r
3630                         }\r
3631                         $name .= $i;\r
3632                 }\r
3633                 \r
3634                 $newid = Template::createNew($name, $desc);\r
3635                 \r
3636                 // 3. create clone\r
3637                 // go through parts of old template and add them to the new one\r
3638                 $query = "SELECT tpartname, tcontent FROM %s WHERE tdesc=%d;";\r
3639                 $query = sprintf($query, sql_table('template'), (integer) $templateid);\r
3640                 \r
3641                 $res = DB::getResult($query);\r
3642                 foreach ( $res as $row )\r
3643                 {\r
3644                         self::addToAdminTemplate($newid, $row['tpartname'], $row['tcontent']);\r
3645                 }\r
3646                 \r
3647                 self::action_admintemplateoverview();\r
3648                 return;\r
3649         }\r
3650 \r
3651         /**\r
3652          * Admin::action_skinoverview()\r
3653          * \r
3654          * @param       void\r
3655          * @return      void\r
3656          */\r
3657         static private function action_skinoverview()\r
3658         {\r
3659                 global $member, $manager;\r
3660                 \r
3661                 $member->isAdmin() or self::disallow();\r
3662                 \r
3663                 self::$skin->parse('skinoverview');\r
3664                 return;\r
3665         }\r
3666         \r
3667         /**\r
3668          * Admin::action_skinnew()\r
3669          * \r
3670          * @param       void\r
3671          * @return      void\r
3672          */\r
3673         static private function action_skinnew()\r
3674         {\r
3675                 global $member;\r
3676                 \r
3677                 $member->isAdmin() or self::disallow();\r
3678                 \r
3679                 $name = trim(postVar('name'));\r
3680                 $desc = trim(postVar('desc'));\r
3681                 \r
3682                 if ( !isValidSkinName($name) )\r
3683                 {\r
3684                         self::error(_ERROR_BADSKINNAME);\r
3685                 }\r
3686                 \r
3687                 if ( SKIN::exists($name) )\r
3688                 {\r
3689                         self::error(_ERROR_DUPSKINNAME);\r
3690                 }\r
3691                 \r
3692                 $newId = SKIN::createNew($name, $desc);\r
3693                 \r
3694                 self::action_skinoverview();\r
3695                 return;\r
3696         }\r
3697         \r
3698         /**\r
3699          * Admin::action_skinedit()\r
3700          * \r
3701          * @param       void\r
3702          * @return      void\r
3703          */\r
3704         static private function action_skinedit()\r
3705         {\r
3706                 global $member, $manager;\r
3707                 \r
3708                 $member->isAdmin() or self::disallow();\r
3709                 \r
3710                 self::$skin->parse('skinedit');\r
3711                 return;\r
3712         }\r
3713         \r
3714         /**\r
3715          * Admin::action_skineditgeneral()\r
3716          * \r
3717          * @param       void\r
3718          * @return      void\r
3719          */\r
3720         static private function action_skineditgeneral()\r
3721         {\r
3722                 global $manager, $member;\r
3723                 \r
3724                 $skinid = intRequestVar('skinid');\r
3725                 \r
3726                 $member->isAdmin() or self::disallow();\r
3727                 \r
3728                 $name           = postVar('name');\r
3729                 $desc           = postVar('desc');\r
3730                 $type           = postVar('type');\r
3731                 $inc_mode       = postVar('inc_mode');\r
3732                 $inc_prefix     = postVar('inc_prefix');\r
3733                 \r
3734                 $skin =& $manager->getSkin($skinid);\r
3735                 \r
3736                 // 1. Some checks\r
3737                 if ( !isValidSkinName($name) )\r
3738                 {\r
3739                         self::error(_ERROR_BADSKINNAME);\r
3740                 }\r
3741                 \r
3742                 if ( ($skin->getName() != $name) && SKIN::exists($name) )\r
3743                 {\r
3744                         self::error(_ERROR_DUPSKINNAME);\r
3745                 }\r
3746                 \r
3747                 if ( !$type )\r
3748                 {\r
3749                         $type = 'text/html';\r
3750                 }\r
3751                 if ( !$inc_mode )\r
3752                 {\r
3753                         $inc_mode = 'normal';\r
3754                 }\r
3755                 \r
3756                 // 2. Update description\r
3757                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
3758                 \r
3759                 self::action_skinedit();\r
3760                 return;\r
3761         }\r
3762         \r
3763         static private function action_skinedittype($msg = '')\r
3764         {\r
3765                 global $member, $manager;\r
3766                 \r
3767                 $member->isAdmin() or self::disallow();\r
3768                 \r
3769                 if ( $msg )\r
3770                 {\r
3771                         self::$headMess = $msg;\r
3772                 }\r
3773                 \r
3774                 $skinid = intRequestVar('skinid');\r
3775                 $type   = requestVar('type');\r
3776                 $type   = trim($type);\r
3777                 $type   = strtolower($type);\r
3778                 \r
3779                 if ( !isValidShortName($type) )\r
3780                 {\r
3781                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
3782                 }\r
3783                 \r
3784                 self::$skin->parse('skinedittype');\r
3785                 return;\r
3786         }\r
3787         \r
3788         /**\r
3789          * Admin::action_skinupdate()\r
3790          * \r
3791          * @param       void\r
3792          * @return      void\r
3793          */\r
3794         static private function action_skinupdate()\r
3795         {\r
3796                 global $manager, $member;\r
3797                 \r
3798                 $skinid = intRequestVar('skinid');\r
3799                 $content = trim(postVar('content'));\r
3800                 $type = postVar('type');\r
3801                 \r
3802                 $member->isAdmin() or self::disallow();\r
3803                 \r
3804                 $skin =& $manager->getSKIN($skinid);\r
3805                 $skin->update($type, $content);\r
3806                 \r
3807                 self::action_skinedittype(_SKIN_UPDATED);\r
3808                 return;\r
3809         }\r
3810         \r
3811         /**\r
3812          * Admin::action_skindelete()\r
3813          * \r
3814          * @param       void\r
3815          * @return      void\r
3816          */\r
3817         static private function action_skindelete()\r
3818         {\r
3819                 global $manager, $member, $CONF;\r
3820                 \r
3821                 $skinid = intRequestVar('skinid');\r
3822                 \r
3823                 $member->isAdmin() or self::disallow();\r
3824                 \r
3825                 // don't allow default skin to be deleted\r
3826                 if ( $skinid == $CONF['BaseSkin'] )\r
3827                 {\r
3828                         self::error(_ERROR_DEFAULTSKIN);\r
3829                 }\r
3830                 \r
3831                 // don't allow deletion of default skins for blogs\r
3832                 $query = "SELECT bname FROM %s WHERE bdefskin=%d";\r
3833                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3834                 \r
3835                 $name = DB::getValue($query);\r
3836                 if ( $name )\r
3837                 {\r
3838                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3839                 }\r
3840                 \r
3841                 self::$skin->parse('skindelete');\r
3842                 return;\r
3843         }\r
3844         \r
3845         /**\r
3846          * Admin::action_skindeleteconfirm()\r
3847          * \r
3848          * @param       void\r
3849          * @return      void\r
3850          */\r
3851         static private function action_skindeleteconfirm()\r
3852         {\r
3853                 global $member, $CONF, $manager;\r
3854                 \r
3855                 $skinid = intRequestVar('skinid');\r
3856                 \r
3857                 $member->isAdmin() or self::disallow();\r
3858                 \r
3859                 // don't allow default skin to be deleted\r
3860                 if ( $skinid == $CONF['BaseSkin'] )\r
3861                 {\r
3862                         self::error(_ERROR_DEFAULTSKIN);\r
3863                 }\r
3864                 \r
3865                 // don't allow deletion of default skins for blogs\r
3866                 $query = "SELECT bname FROM %s WHERE bdefskin=%d;";\r
3867                 $query = sprintf($query, sql_table('blog'), (integer) $skinid);\r
3868                 \r
3869                 $name = DB::getValue($query);\r
3870                 if ( $name )\r
3871                                 {\r
3872                         self::error(_ERROR_SKINDEFDELETE . Entity::hsc($name));\r
3873                 }\r
3874                 \r
3875                 $data = array('skinid' => $skinid);\r
3876                 $manager->notify('PreDeleteSkin', $data);\r
3877                 \r
3878                 // 1. delete description\r
3879                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
3880                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
3881                 DB::execute($query);\r
3882                 \r
3883                 // 2. delete parts\r
3884                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
3885                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
3886                 DB::execute($query);\r
3887                 \r
3888                 $data = array('skinid' => $skinid);\r
3889                 $manager->notify('PostDeleteSkin', $data);\r
3890                 \r
3891                 self::action_skinoverview();\r
3892                 return;\r
3893         }\r
3894         \r
3895         /**\r
3896          * Admin::action_skinremovetype()\r
3897          * \r
3898          * @param       void\r
3899          * @return      void\r
3900          */\r
3901         static private function action_skinremovetype()\r
3902         {\r
3903                 global $member, $manager, $CONF;\r
3904                 \r
3905                 $member->isAdmin() or self::disallow();\r
3906                 \r
3907                 $skinid = intRequestVar('skinid');\r
3908                 $skintype = requestVar('type');\r
3909                 \r
3910                 if ( !isValidShortName($skintype) )\r
3911                 {\r
3912                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3913                 }\r
3914                 \r
3915                 // don't allow default skinparts to be deleted\r
3916                 /* TODO: this array should be retrieved from Action class */\r
3917                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3918                 {\r
3919                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3920                 }\r
3921                 \r
3922                 self::$skin->parse('skinremovetype');\r
3923                 return;\r
3924         }\r
3925         \r
3926         /**\r
3927          * Admin::action_skinremovetypeconfirm()\r
3928          * \r
3929          * @param       void\r
3930          * @return      void\r
3931          */\r
3932         static private function action_skinremovetypeconfirm()\r
3933         {\r
3934                 global $member, $CONF, $manager;\r
3935                 \r
3936                 $member->isAdmin() or self::disallow();\r
3937                 \r
3938                 $skinid = intRequestVar('skinid');\r
3939                 $skintype = requestVar('type');\r
3940                 \r
3941                 if ( !isValidShortName($skintype) )\r
3942                 {\r
3943                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3944                 }\r
3945                 \r
3946                 // don't allow default skinparts to be deleted\r
3947                 /* TODO: this array should be retrieved from Action class */\r
3948                 if ( in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup')) )\r
3949                 {\r
3950                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
3951                 }\r
3952                 \r
3953                 $data = array(\r
3954                         'skinid'   => $skinid,\r
3955                         'skintype' => $skintype\r
3956                 );\r
3957                 $manager->notify('PreDeleteSkinPart', $data);\r
3958                 // delete part\r
3959                 $query = "DELETE FROM %s WHERE sdesc=%d AND stype=%s;";\r
3960                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
3961                 DB::execute($query);\r
3962                 \r
3963                 $data = array(\r
3964                         'skinid'   => $skinid,\r
3965                         'skintype' => $skintype\r
3966                 );\r
3967                 $manager->notify('PostDeleteSkinPart', $data);\r
3968                 \r
3969                 self::action_skinedit();\r
3970                 return;\r
3971         }\r
3972 \r
3973         /**\r
3974          * Admin::action_skinclone()\r
3975          * \r
3976          * @param       void\r
3977          * @return      void\r
3978          */\r
3979         static private function action_skinclone()\r
3980         {\r
3981                 global $manager, $member;\r
3982                 \r
3983                 $member->isAdmin() or self::disallow();\r
3984                 \r
3985                 $skinid = intRequestVar('skinid');\r
3986                 \r
3987                 // 1. read skin to clone\r
3988                 $skin =& $manager->getSkin($skinid);\r
3989                 \r
3990                 $name = "{$skin->getName()}_clone";\r
3991                 \r
3992                 // if a skin with that name already exists:\r
3993                 if ( Skin::exists($name) )\r
3994                 {\r
3995                         $i = 1;\r
3996                         while ( Skin::exists($name . $i) )\r
3997                         {\r
3998                                 $i++;\r
3999                         }\r
4000                         $name .= $i;\r
4001                 }\r
4002                 \r
4003                 // 2. create skin desc\r
4004                 $newid = Skin::createNew(\r
4005                         $name,\r
4006                         $skin->getDescription(),\r
4007                         $skin->getContentType(),\r
4008                         $skin->getIncludeMode(),\r
4009                         $skin->getIncludePrefix()\r
4010                 );\r
4011                 \r
4012                 // 3. clone\r
4013                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4014                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4015                 \r
4016                 $res = DB::getResult($query);\r
4017                 foreach ( $res as $row )\r
4018                 {\r
4019                         self::skinclonetype($skin, $newid, $row['stype']);\r
4020                 }\r
4021                 \r
4022                 self::action_skinoverview();\r
4023                 return;\r
4024         }\r
4025         \r
4026         /**\r
4027          * Admin::skinclonetype()\r
4028          * \r
4029          * @param       String  $skin   Skin object\r
4030          * @param       Integer $newid  ID for this clone\r
4031          * @param       String  $type   type of skin\r
4032          * @return      Void\r
4033          */\r
4034         static private function skinclonetype($skin, $newid, $type)\r
4035         {\r
4036                 $newid = intval($newid);\r
4037                 $content = $skin->getContentFromDB($type);\r
4038                 \r
4039                 if ( $content )\r
4040                 {\r
4041                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4042                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4043                         DB::execute($query);\r
4044                 }\r
4045                 return;\r
4046         }\r
4047         \r
4048         /**\r
4049          * Admin::action_adminskinoverview()\r
4050          * \r
4051          * @param       void\r
4052          * @return      void\r
4053          */\r
4054         static private function action_adminskinoverview()\r
4055         {\r
4056                 global $member, $manager;\r
4057                 \r
4058                 $member->isAdmin() or self::disallow();\r
4059                 \r
4060                 self::$skin->parse('adminskinoverview');\r
4061                 return;\r
4062         }\r
4063         \r
4064         /**\r
4065          * Admin::action_adminskinnew()\r
4066          * \r
4067          * @param       void\r
4068          * @return      void\r
4069          */\r
4070         static private function action_adminskinnew()\r
4071         {\r
4072                 global $member;\r
4073                 $member->isAdmin() or self::disallow();\r
4074                 $name = trim(postVar('name'));\r
4075                 $desc = trim(postVar('desc'));\r
4076                 \r
4077                 if ( !isValidSkinName($name) )\r
4078                 {\r
4079                         self::error(_ERROR_BADSKINNAME);\r
4080                 }\r
4081                 else if ( !preg_match('#^admin/#', $name) )\r
4082                 {\r
4083                         self::error(_ERROR_BADADMINSKINNAME);\r
4084                 }\r
4085                 else if ( Skin::exists($name) )\r
4086                 {\r
4087                         self::error(_ERROR_DUPSKINNAME);\r
4088                 }\r
4089                 /* TODO: $newId is not reused... */\r
4090                 $newId = Skin::createNew($name, $desc);\r
4091                 self::action_adminskinoverview();\r
4092                 return;\r
4093         }\r
4094         \r
4095         /**\r
4096          * Admin::action_adminskinedit()\r
4097          * \r
4098          * @param       void\r
4099          * @return      void\r
4100          */\r
4101         static private function action_adminskinedit()\r
4102         {\r
4103                 global $member, $manager;\r
4104                 \r
4105                 $member->isAdmin() or self::disallow();\r
4106                 self::$skin->parse('adminskinedit');\r
4107                 return;\r
4108         }\r
4109         \r
4110         /**\r
4111          * Admin::action_adminskineditgeneral()\r
4112          * \r
4113          * @param       void\r
4114          * @return      void\r
4115          */\r
4116         static private function action_adminskineditgeneral()\r
4117         {\r
4118                 global $manager, $member;\r
4119                 \r
4120                 $skinid = intRequestVar('skinid');\r
4121                 \r
4122                 $member->isAdmin() or self::disallow();\r
4123                 \r
4124                 $name           = postVar('name');\r
4125                 $desc           = postVar('desc');\r
4126                 $type           = postVar('type');\r
4127                 $inc_mode       = postVar('inc_mode');\r
4128                 $inc_prefix     = postVar('inc_prefix');\r
4129                 \r
4130                 $skin =& $manager->getSkin($skinid, 'AdminActions', 'AdminSkin');\r
4131                 \r
4132                 // 1. Some checks\r
4133                 if ( !isValidSkinName($name) )\r
4134                 {\r
4135                         self::error(_ERROR_BADSKINNAME);\r
4136                 }\r
4137                 if ( ($skin->getName() != $name) && Skin::exists($name) )\r
4138                 {\r
4139                         self::error(_ERROR_DUPSKINNAME);\r
4140                 }\r
4141                 if ( !$type )\r
4142                 {\r
4143                         $type = 'text/html';\r
4144                 }\r
4145                 if ( !$inc_mode )\r
4146                 {\r
4147                         $inc_mode = 'normal';\r
4148                 }\r
4149                 // 2. Update description\r
4150                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);\r
4151                 self::action_adminskinedit();\r
4152                 return;\r
4153         }\r
4154         \r
4155         /**\r
4156          * Admin::action_adminskinedittype()\r
4157          * \r
4158          * @param       string  $msg    message for pageheader\r
4159          * @return      void\r
4160          */\r
4161         static private function action_adminskinedittype($msg = '')\r
4162         {\r
4163                 global $member, $manager;\r
4164                 \r
4165                 $member->isAdmin() or self::disallow();\r
4166                 \r
4167                 if ( $msg )\r
4168                 {\r
4169                         self::$headMess = $msg;\r
4170                 }\r
4171                 $type = requestVar('type');\r
4172                 $type = trim($type);\r
4173                 $type = strtolower($type);\r
4174                 \r
4175                 if ( !isValidShortName($type) )\r
4176                 {\r
4177                         self::error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);\r
4178                 }\r
4179                 \r
4180                 self::$skin->parse('adminskinedittype');\r
4181                 return;\r
4182         }\r
4183         \r
4184         /**\r
4185          * Admin::action_adminskinupdate()\r
4186          * \r
4187          * @param       void\r
4188          * @return      void\r
4189          */\r
4190         static private function action_adminskinupdate()\r
4191         {\r
4192                 global $manager, $member;\r
4193                 \r
4194                 $skinid = intRequestVar('skinid');\r
4195                 $content = trim(postVar('content'));\r
4196                 $type = postVar('type');\r
4197                 \r
4198                 $member->isAdmin() or self::disallow();\r
4199                 \r
4200                 $skin =& $manager->getSkin($skinid, 'Admin', 'AdminSkin');\r
4201                 $skin->update($type, $content);\r
4202                 self::action_adminskinedittype(_SKIN_UPDATED);\r
4203                 return;\r
4204         }\r
4205         \r
4206         /**\r
4207          * Admin::action_adminskindelete()\r
4208          * \r
4209          * @param       void\r
4210          * @return      void\r
4211          */\r
4212         static private function action_adminskindelete()\r
4213         {\r
4214                 global $member, $manager, $CONF;\r
4215                 $member->isAdmin() or self::disallow();\r
4216                 \r
4217                 /* TODO: needless variable $skinid... */\r
4218                 $skinid = intRequestVar('skinid');\r
4219                 self::$skin->parse('adminskindelete');\r
4220                 return;\r
4221         }\r
4222 \r
4223         /**\r
4224          * Admin::action_adminskindeleteconfirm()\r
4225          * \r
4226          * @param       void\r
4227          * @return      void\r
4228          */\r
4229         static private function action_adminskindeleteconfirm()\r
4230         {\r
4231                 global $member, $CONF, $manager;\r
4232                 \r
4233                 $member->isAdmin() or self::disallow();\r
4234                 $skinid = intRequestVar('skinid');\r
4235                 \r
4236                 // don't allow default skin to be deleted\r
4237                 if ( $skinid == $CONF['AdminSkin'] )\r
4238                 {\r
4239                         self::error(_ERROR_DEFAULTSKIN);\r
4240                 }\r
4241                 \r
4242                 /*\r
4243                  * TODO: NOT Implemented\r
4244                  *  don't allow deletion of default skins for members\r
4245                 $memberDefaults =  $member->getAdminSkin();\r
4246                 foreach ( $memberDefaults as $memID => $adminskin )\r
4247                 {\r
4248                         if ( $skinid == $adminskin )\r
4249                         {\r
4250                                 $mem =& $manager->getMember($memID);\r
4251                                 self::error(_ERROR_SKINDEFDELETE . $mem->displayname);\r
4252                         }\r
4253                 }\r
4254                 */\r
4255                 \r
4256                 $manager->notify('PreDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4257                 \r
4258                 // 1. delete description\r
4259                 $query = "DELETE FROM %s WHERE sdnumber=%d;";\r
4260                 $query = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
4261                 DB::execute($query);\r
4262                 \r
4263                 // 2. delete parts\r
4264                 $query = "DELETE FROM %s WHERE sdesc=%d;";\r
4265                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4266                 \r
4267                 DB::execute($query);\r
4268                 \r
4269                 $manager->notify('PostDeleteAdminSkin', array('skinid' => (integer) $skinid));\r
4270                 self::action_adminskinoverview();\r
4271                 return;\r
4272         }\r
4273         \r
4274         /**\r
4275          * Admin::action_adminskinremovetype()\r
4276          * \r
4277          * @param       void\r
4278          * @return      void\r
4279          */\r
4280         static private function action_adminskinremovetype()\r
4281         {\r
4282                 global $member, $manager, $CONF;\r
4283 \r
4284                 $member->isAdmin() or self::disallow();\r
4285                 \r
4286                 $skinid         = intRequestVar('skinid');\r
4287                 $skintype       = requestVar('type');\r
4288                 \r
4289                 if ( !isValidShortName($skintype) )\r
4290                 {\r
4291                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4292                 }\r
4293                 \r
4294                 self::$skin->parse('adminskinremovetype');\r
4295                 return;\r
4296         }\r
4297         \r
4298         /**\r
4299          * Admin::action_adminskinremovetypeconfirm()\r
4300          * \r
4301          * @param       void\r
4302          * @return      void\r
4303          */\r
4304         static private function action_adminskinremovetypeconfirm()\r
4305         {\r
4306                 global $member, $CONF, $manager;\r
4307                 \r
4308                 $member->isAdmin() or self::disallow();\r
4309                 \r
4310                 $skinid         = intRequestVar('skinid');\r
4311                 $skintype       = requestVar('type');\r
4312                 \r
4313                 if ( !isValidShortName($skintype) )\r
4314                 {\r
4315                         self::error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);\r
4316                 }\r
4317                 \r
4318                 $data =array(\r
4319                         'skinid'        => $skinid,\r
4320                         'skintype'      => $skintype\r
4321                 );\r
4322                 $manager->notify('PreDeleteAdminSkinPart', $data);\r
4323 \r
4324                 // delete part\r
4325                 $query = 'DELETE FROM %s WHERE sdesc = %d AND stype = %s ;';\r
4326                 $query = sprintf($query, sql_table('skin'), (integer) $skinid, DB::quoteValue($skintype) );\r
4327                 DB::execute($query);\r
4328                 \r
4329                 $data = array(\r
4330                         'skinid'        => $skinid,\r
4331                         'skintype'      => $skintype\r
4332                 );\r
4333                 $manager->notify('PostDeleteAdminSkinPart', $data);\r
4334                 \r
4335                 self::action_adminskinedit();\r
4336                 return;\r
4337         }\r
4338 \r
4339         /**\r
4340          * Admin::action_adminskinclone()\r
4341          * \r
4342          * @param       void\r
4343          * @return      void\r
4344          */\r
4345         static private function action_adminskinclone()\r
4346         {\r
4347                 global $manager, $member;\r
4348                 \r
4349                 $member->isAdmin() or self::disallow();\r
4350                 \r
4351                 $skinid = intRequestVar('skinid');\r
4352                 \r
4353                 // 1. read skin to clone\r
4354                 $skin =& $manager->getSkin($skinid, 'Admin', 'AdminSkin');\r
4355                 $name = "{$skin->getName()}_clone";\r
4356                 \r
4357                 // if a skin with that name already exists:\r
4358                 if ( Skin::exists($name) )\r
4359                 {\r
4360                         $i = 1;\r
4361                         while ( Skin::exists($name . $i) )\r
4362                         {\r
4363                                 $i++;\r
4364                         }\r
4365                         $name .= $i;\r
4366                 }\r
4367                 \r
4368                 // 2. create skin desc\r
4369                 $newid = Skin::createNew(\r
4370                         $name,\r
4371                         $skin->getDescription(),\r
4372                         $skin->getContentType(),\r
4373                         $skin->getIncludeMode(),\r
4374                         $skin->getIncludePrefix()\r
4375                 );\r
4376                 \r
4377                 // 3. clone\r
4378                 $query = "SELECT stype FROM %s WHERE sdesc=%d;";\r
4379                 $query = sprintf($query, sql_table('skin'), (integer) $skinid);\r
4380                 \r
4381                 $res = DB::getResult($query);\r
4382                 foreach ( $res as $row )\r
4383                 {\r
4384                         self::skinclonetype($skin, $newid, $row['stype']);\r
4385                 }\r
4386                 self::action_adminskinoverview();\r
4387                 return;\r
4388         }\r
4389         \r
4390         /**\r
4391          * Admin::adminskinclonetype()\r
4392          * \r
4393          * @param       string  $skin   an instance of Skin class\r
4394          * @param       integer $newid  ID for new skin\r
4395          * @param       string  $type   skin type\r
4396          * @return      void\r
4397          */\r
4398         static private function adminskinclonetype($skin, $newid, $type)\r
4399         {\r
4400                 $content = $skin->getContentFromDB($type);\r
4401                 \r
4402                 if ( $content )\r
4403                 {\r
4404                         $query = "INSERT INTO %s (sdesc, scontent, stype) VALUES (%d, %s, %s)";\r
4405                         $query = sprintf($query, sql_table('skin'), (integer) $newid, DB::quoteValue($content), DB::quoteValue($type));\r
4406                         DB::execute($query);\r
4407                 }\r
4408                 return;\r
4409         }\r
4410         \r
4411         /**\r
4412          * Admin::action_adminskinieoverview()\r
4413          * \r
4414          * @param       void\r
4415          * @return      void\r
4416          */\r
4417         static private function action_adminskinieoverview()\r
4418         {\r
4419                 global $member, $DIR_LIBS, $manager;\r
4420                 \r
4421                 $member->isAdmin() or self::disallow();\r
4422                 \r
4423                 // load skinie class\r
4424                 include_once($DIR_LIBS . 'skinie.php');\r
4425                 \r
4426                 self::$skin->parse('adminskinieoverview');\r
4427                 return;\r
4428         }\r
4429 \r
4430         /**\r
4431          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4432          * Admin::action_adminskinieimport()\r
4433          * \r
4434          * @param       void\r
4435          * @return      void\r
4436          */\r
4437         static private function action_adminskinieimport()\r
4438         {\r
4439                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4440                 \r
4441                 $member->isAdmin() or self::disallow();\r
4442                 \r
4443                 // load skinie class\r
4444                 include_once($DIR_LIBS . 'skinie.php');\r
4445                 \r
4446                 $skinFileRaw    = postVar('skinfile');\r
4447                 $mode                   = postVar('mode');\r
4448                 \r
4449                 $importer = new SKINIMPORT();\r
4450                 \r
4451                 // get full filename\r
4452                 if ( $mode == 'file' )\r
4453                 {\r
4454                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4455                         \r
4456                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4457                         if ( !file_exists($skinFile) )\r
4458                         {\r
4459                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4460                         }\r
4461                 }\r
4462                 else\r
4463                 {\r
4464                         $skinFile = $skinFileRaw;\r
4465                 }\r
4466                 \r
4467                 // read only metadata\r
4468                 $error = $importer->readFile($skinFile, 1);\r
4469                 if ( $error )\r
4470                 {\r
4471                         self::error($error);\r
4472                 }\r
4473                 \r
4474                 /* TODO: we should consider to use the other way instead of this */\r
4475                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4476                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4477                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4478                 \r
4479                 // clashes\r
4480                 $skinNameClashes                        = $importer->checkSkinNameClashes();\r
4481                 $templateNameClashes            = $importer->checkTemplateNameClashes();\r
4482                 $hasNameClashes                         = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);\r
4483                 /* TODO: we should consider to use the other way instead of this */\r
4484                 $_REQUEST['skinclashes']        = $skinNameClashes;\r
4485                 $_REQUEST['tpltclashes']        = $templateNameClashes;\r
4486                 $_REQUEST['nameclashes']        = $hasNameClashes ? 1 : 0;\r
4487 \r
4488                 if ( !is_object(self::$skin) )\r
4489                 {\r
4490                         self::action_adminskiniedoimport();\r
4491                 }\r
4492                 else\r
4493                 {\r
4494                         self::$skin->parse('adminskinieimport');\r
4495                 }\r
4496                 return;\r
4497         }\r
4498         \r
4499         /**\r
4500          * FIXME: DUPLICATION, NO NEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEED!!!!!!\r
4501          * Admin::action_adminskiniedoimport()\r
4502          * \r
4503          * @param       void\r
4504          * @return      void\r
4505          */\r
4506         static private function action_adminskiniedoimport()\r
4507         {\r
4508                 global $DIR_LIBS, $DIR_SKINS, $manager, $member;\r
4509                 \r
4510                 $member->isAdmin() or self::disallow();\r
4511                 \r
4512                 // load skinie class\r
4513                 include_once($DIR_LIBS . 'skinie.php');\r
4514                 \r
4515                 $skinFileRaw    = postVar('skinfile');\r
4516                 $mode                   = postVar('mode');\r
4517                 $allowOverwrite = intPostVar('overwrite');\r
4518                 \r
4519                 // get full filename\r
4520                 if ( $mode == 'file' )\r
4521                 {\r
4522                         $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skinbackup.xml";\r
4523                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)\r
4524                         if ( !file_exists($skinFile) )\r
4525                         {\r
4526                                 $skinFile = "{$DIR_SKINS}admin/{$skinFileRaw}/skindata.xml";\r
4527                         }\r
4528                 }\r
4529                 else\r
4530                 {\r
4531                         $skinFile = $skinFileRaw;\r
4532                 }\r
4533                 \r
4534                 $importer = new SKINIMPORT();\r
4535                 \r
4536                 $error = $importer->readFile($skinFile);\r
4537                 if ( $error )\r
4538                 {\r
4539                         self::error($error);\r
4540                 }\r
4541                 \r
4542                 $error = $importer->writeToDatabase($allowOverwrite);\r
4543                 if ( $error )\r
4544                 {\r
4545                         self::error($error);\r
4546                 }\r
4547                 \r
4548                 /* TODO: we should consider to use the other way instead of this */\r
4549                 $_REQUEST['skininfo']   = $importer->getInfo();\r
4550                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
4551                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
4552                 \r
4553                 if ( !is_object(self::$skin) )\r
4554                 {\r
4555                         global $DIR_SKINS;\r
4556                         $query  = "SELECT min(sdnumber) FROM %s WHERE sdname != 'admin/bookmarklet' AND sdname LIKE 'admin/%%'";\r
4557                         $query  = sprintf($query, sql_table('skin_desc'));\r
4558                         $res    = intval(DB::getValue($query));\r
4559                         $query  = "UPDATE %s SET value = %d WHERE name = 'AdminSkin'";\r
4560                         $query  = sprintf($query, sql_table('config'), $res);\r
4561                         DB::execute($query);\r
4562                         $skin   =& $manager->Skin(0, 'AdminActions', 'AdminSkin');\r
4563                         $skin->parse('importAdmin', $DIR_SKINS . 'admin/defaultimporter.skn');\r
4564                 }\r
4565                 else\r
4566                 {\r
4567                         self::$skin->parse('adminskiniedoimport');\r
4568                 }\r
4569                 return;\r
4570         }\r
4571 \r
4572         /**\r
4573          * Admin::action_adminskinieexport()\r
4574          * \r
4575          * @param       void\r
4576          * @return      void\r
4577          */\r
4578         static private function action_adminskinieexport()\r
4579         {\r
4580                 global $member, $DIR_PLUGINS;\r
4581                 \r
4582                 $member->isAdmin() or self::disallow();\r
4583                 \r
4584                 // load skinie class\r
4585                 $aSkins = requestIntArray('skin');\r
4586                 if (!is_array($aSkins)) {\r
4587                         $aSkins = array();\r
4588                 }\r
4589                 $skinList = array_keys($aSkins);\r
4590                 \r
4591                 $aTemplates = requestIntArray('template');\r
4592                 if (!is_array($aTemplates))\r
4593                 {\r
4594                         $aTemplates = array();\r
4595                 }\r
4596                 $templateList = array_keys($aTemplates);\r
4597                 \r
4598                 $info = postVar('info');\r
4599                 \r
4600                 include_libs('skinie.php');\r
4601                 $exporter = new SkinExport();\r
4602                 foreach ( $skinList as $skinId )\r
4603                 {\r
4604                         $exporter->addSkin($skinId);\r
4605                 }\r
4606                 foreach ( $templateList as $templateId )\r
4607                 {\r
4608                         $exporter->addTemplate($templateId);\r
4609                 }\r
4610                 $exporter->setInfo($info);\r
4611                 $exporter->export();\r
4612                 return;\r
4613         }\r
4614         \r
4615         /**\r
4616          * Admin::action_settingsedit()\r
4617          * \r
4618          * @param       Void\r
4619          * @return      Void\r
4620          */\r
4621         static private function action_settingsedit()\r
4622         {\r
4623                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;\r
4624                 \r
4625                 $member->isAdmin() or self::disallow();\r
4626                 \r
4627                 self::$skin->parse('settingsedit');\r
4628                 return;\r
4629         }\r
4630         \r
4631         /**\r
4632          * Admin::action_settingsupdate()\r
4633          * Update $CONFIG and redirect\r
4634          * \r
4635          * @param       void\r
4636          * @return      void\r
4637          */\r
4638         static private function action_settingsupdate()\r
4639         {\r
4640                 global $member, $CONF;\r
4641                 \r
4642                 $member->isAdmin() or self::disallow();\r
4643                 \r
4644                 // check if email address for admin is valid\r
4645                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )\r
4646                 {\r
4647                         self::error(_ERROR_BADMAILADDRESS);\r
4648                 }\r
4649                 \r
4650                 // save settings\r
4651                 self::updateConfig('DefaultBlog',               postVar('DefaultBlog'));\r
4652                 self::updateConfig('BaseSkin',                  postVar('BaseSkin'));\r
4653                 self::updateConfig('IndexURL',                  postVar('IndexURL'));\r
4654                 self::updateConfig('AdminURL',                  postVar('AdminURL'));\r
4655                 self::updateConfig('PluginURL',                 postVar('PluginURL'));\r
4656                 self::updateConfig('SkinsURL',                  postVar('SkinsURL'));\r
4657                 self::updateConfig('ActionURL',                 postVar('ActionURL'));\r
4658                 self::updateConfig('Locale',                    postVar('Locale'));\r
4659                 self::updateConfig('AdminEmail',                postVar('AdminEmail'));\r
4660                 self::updateConfig('SessionCookie',             postVar('SessionCookie'));\r
4661                 self::updateConfig('AllowMemberCreate', postVar('AllowMemberCreate'));\r
4662                 self::updateConfig('AllowMemberMail',   postVar('AllowMemberMail'));\r
4663                 self::updateConfig('NonmemberMail',             postVar('NonmemberMail'));\r
4664                 self::updateConfig('ProtectMemNames',   postVar('ProtectMemNames'));\r
4665                 self::updateConfig('SiteName',                  postVar('SiteName'));\r
4666                 self::updateConfig('NewMemberCanLogon', postVar('NewMemberCanLogon'));\r
4667                 self::updateConfig('DisableSite',               postVar('DisableSite'));\r
4668                 self::updateConfig('DisableSiteURL',    postVar('DisableSiteURL'));\r
4669                 self::updateConfig('LastVisit',                 postVar('LastVisit'));\r
4670                 self::updateConfig('MediaURL',                  postVar('MediaURL'));\r
4671                 self::updateConfig('AllowedTypes',              postVar('AllowedTypes'));\r
4672                 self::updateConfig('AllowUpload',               postVar('AllowUpload'));\r
4673                 self::updateConfig('MaxUploadSize',             postVar('MaxUploadSize'));\r
4674                 self::updateConfig('MediaPrefix',               postVar('MediaPrefix'));\r
4675                 self::updateConfig('AllowLoginEdit',    postVar('AllowLoginEdit'));\r
4676                 self::updateConfig('DisableJsTools',    postVar('DisableJsTools'));\r
4677                 self::updateConfig('CookieDomain',              postVar('CookieDomain'));\r
4678                 self::updateConfig('CookiePath',                postVar('CookiePath'));\r
4679                 self::updateConfig('CookieSecure',              postVar('CookieSecure'));\r
4680                 self::updateConfig('URLMode',                   postVar('URLMode'));\r
4681                 self::updateConfig('CookiePrefix',              postVar('CookiePrefix'));\r
4682                 self::updateConfig('DebugVars',                 postVar('DebugVars'));\r
4683                 self::updateConfig('DefaultListSize',   postVar('DefaultListSize'));\r
4684                 self::updateConfig('AdminCSS',                  postVar('AdminCSS'));\r
4685                 \r
4686                 // load new config and redirect (this way, the new locale will be used is necessary)\r
4687                 // note that when changing cookie settings, this redirect might cause the user\r
4688                 // to have to log in again.\r
4689                 getConfig();\r
4690                 redirect($CONF['AdminURL'] . '?action=manage');\r
4691                 return;\r
4692         }\r
4693         \r
4694         /**\r
4695          * Admin::action_systemoverview()\r
4696          * Output system overview\r
4697          * \r
4698          * @param       void\r
4699          * @return      void\r
4700          */\r
4701         static private function action_systemoverview()\r
4702         {\r
4703                 self::$skin->parse('systemoverview');\r
4704                 return;\r
4705         }\r
4706         \r
4707         /**\r
4708          * Admin::updateConfig()\r
4709          * \r
4710          * @param       string  $name   \r
4711          * @param       string  $val    \r
4712          * @return      integer return the ID in which the latest query posted\r
4713          */\r
4714         static private function updateConfig($name, $val)\r
4715         {\r
4716                 $query = "UPDATE %s SET value=%s WHERE name=%s";\r
4717                 $query = sprintf($query, sql_table('config'), DB::quoteValue($val), DB::quoteValue($name));\r
4718                 if ( DB::execute($query) === FALSE )\r
4719                 {\r
4720                         $err = DB::getError();\r
4721                         die(_ADMIN_SQLDIE_QUERYERROR . $err[2]);\r
4722                 }\r
4723                 return DB::getInsertId();\r
4724         }\r
4725         \r
4726         /**\r
4727          * Admin::error()\r
4728          * Error message\r
4729          * \r
4730          * @param       string  $msg    message that will be shown\r
4731          * @return      void\r
4732          */\r
4733         static public function error($msg)\r
4734         {\r
4735                 self::$headMess = $msg;\r
4736                 self::$skin->parse('adminerrorpage');\r
4737                 return;\r
4738         }\r
4739         \r
4740         /**\r
4741          * Admin::disallow()\r
4742          * add error log and show error page \r
4743          * \r
4744          * @param       void\r
4745          * @return      void\r
4746          */\r
4747         static public function disallow()\r
4748         {\r
4749                 ActionLog::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));\r
4750                 self::error(_ERROR_DISALLOWED);\r
4751                 return;\r
4752         }\r
4753 \r
4754         /**\r
4755          * Admin::action_PluginAdmin()\r
4756          * Output pluginadmin\r
4757          *\r
4758          * @param       string  $skinContents\r
4759          * @param       string  $extrahead\r
4760          * @return      void\r
4761          */\r
4762         static public function action_PluginAdmin($skinContents, $extrahead = '')\r
4763         {\r
4764                 self::$extrahead .= $extrahead;\r
4765                 self::$skin->parse('pluginadmin', $skinContents);\r
4766                 return;\r
4767         }\r
4768         \r
4769         /**\r
4770          * Admin::action_bookmarklet()\r
4771          * \r
4772          * @param       void\r
4773          * @return      void\r
4774          */\r
4775         static private function action_bookmarklet()\r
4776         {\r
4777                 global $member, $manager;\r
4778                 \r
4779                 $blogid = intRequestVar('blogid');\r
4780                 $member->teamRights($blogid) or self::disallow();\r
4781                 \r
4782                 self::$skin->parse('bookmarklet');\r
4783                 return;\r
4784         }\r
4785         \r
4786         /**\r
4787          * Admin::action_actionlog()\r
4788          * \r
4789          * @param       void\r
4790          * @return      void\r
4791          */\r
4792         static private function action_actionlog()\r
4793         {\r
4794                 global $member, $manager;\r
4795                 \r
4796                 $member->isAdmin() or self::disallow();\r
4797                 \r
4798                 self::$skin->parse('actionlog');\r
4799                 return;\r
4800         }\r
4801         \r
4802         /**\r
4803          * Admin::action_banlist()\r
4804          * \r
4805          * @param       void\r
4806          * @return      void\r
4807          */\r
4808         static private function action_banlist()\r
4809         {\r
4810                 global $member, $manager;\r
4811                 \r
4812                 $blogid = intRequestVar('blogid');\r
4813                 $member->blogAdminRights($blogid) or self::disallow();\r
4814                 \r
4815                 self::$skin->parse('banlist');\r
4816                 return;\r
4817         }\r
4818         \r
4819         /**\r
4820          * Admin::action_banlistdelete()\r
4821          * \r
4822          * @param       void\r
4823          * @return      void\r
4824          */\r
4825         static private function action_banlistdelete()\r
4826         {\r
4827                 global $member, $manager;\r
4828                 \r
4829                 $blogid = intRequestVar('blogid');\r
4830                 $member->blogAdminRights($blogid) or self::disallow();\r
4831                 \r
4832                 self::$skin->parse('banlistdelete');\r
4833                 return;\r
4834         }\r
4835         \r
4836         /**\r
4837          * Admin::action_banlistdeleteconfirm()\r
4838          * \r
4839          * @param       void\r
4840          * @return      void\r
4841          */\r
4842         static private function action_banlistdeleteconfirm()\r
4843         {\r
4844                 global $member, $manager;\r
4845                 \r
4846                 $blogid         = intPostVar('blogid');\r
4847                 $allblogs       = postVar('allblogs');\r
4848                 $iprange        = postVar('iprange');\r
4849                 \r
4850                 $member->blogAdminRights($blogid) or self::disallow();\r
4851                 \r
4852                 $deleted = array();\r
4853                 \r
4854                 if ( !$allblogs )\r
4855                 {\r
4856                         if ( Ban::removeBan($blogid, $iprange) )\r
4857                         {\r
4858                                 $deleted[] = $blogid;\r
4859                         }\r
4860                 }\r
4861                 else\r
4862                 {\r
4863                         // get blogs fot which member has admin rights\r
4864                         $adminblogs = $member->getAdminBlogs();\r
4865                         foreach ($adminblogs as $blogje)\r
4866                         {\r
4867                                 if ( Ban::removeBan($blogje, $iprange) )\r
4868                                 {\r
4869                                         $deleted[] = $blogje;\r
4870                                 }\r
4871                         }\r
4872                 }\r
4873                 \r
4874                 if ( sizeof($deleted) == 0 )\r
4875                 {\r
4876                         self::error(_ERROR_DELETEBAN);\r
4877                 }\r
4878                 \r
4879                 /* TODO: we should use other ways */\r
4880                 $_REQUEST['delblogs'] = $deleted;\r
4881                 \r
4882                 self::$skin->parse('banlistdeleteconfirm');\r
4883                 return;\r
4884         }\r
4885         \r
4886         /**\r
4887          * Admin::action_banlistnewfromitem()\r
4888          * \r
4889          * @param       void\r
4890          * @return      void\r
4891          */\r
4892         static private function action_banlistnewfromitem()\r
4893         {\r
4894                 global $manager;\r
4895                 \r
4896                 $itemid = intRequestVar('itemid');\r
4897                 $item =& $manager->getItem($itemid, 1, 1);\r
4898                 self::action_banlistnew($item['blogid']);\r
4899                 return;\r
4900         }\r
4901         \r
4902         /**\r
4903          * Admin::action_banlistnew()\r
4904          * \r
4905          * @param       integer $blogid ID for weblog\r
4906          * @return      void\r
4907          */\r
4908         static private function action_banlistnew($blogid = '')\r
4909         {\r
4910                 global $member, $manager;\r
4911                 \r
4912                 if ( $blogid == '' )\r
4913                 {\r
4914                         $blogid = intRequestVar('blogid');\r
4915                 }\r
4916                 \r
4917                 $ip = requestVar('ip');\r
4918                 \r
4919                 $member->blogAdminRights($blogid) or self::disallow();\r
4920                 \r
4921                 /* TODO: we should consider to use the other way instead of this */\r
4922                 $_REQUEST['blogid'] = $blogid;          \r
4923                 \r
4924                 self::$skin->parse('banlistnew');\r
4925                 \r
4926                 return;\r
4927         }\r
4928 \r
4929         /**\r
4930          * Admin::action_banlistadd()\r
4931          * \r
4932          * @param       void\r
4933          * @return      void\r
4934          */\r
4935         static private function action_banlistadd()\r
4936         {\r
4937                 global $member;\r
4938                 \r
4939                 $blogid         = intPostVar('blogid');\r
4940                 $allblogs       = postVar('allblogs');\r
4941                 $iprange        = postVar('iprange');\r
4942                 \r
4943                 if ( $iprange == "custom" )\r
4944                 {\r
4945                         $iprange = postVar('customiprange');\r
4946                 }\r
4947                 $reason   = postVar('reason');\r
4948                 \r
4949                 $member->blogAdminRights($blogid) or self::disallow();\r
4950                 \r
4951                 // TODO: check IP range validity\r
4952                 \r
4953                 if ( !$allblogs )\r
4954                 {\r
4955                         if ( !Ban::addBan($blogid, $iprange, $reason) )\r
4956                         {\r
4957                                 self::error(_ERROR_ADDBAN);\r
4958                         }\r
4959                 }\r
4960                 else\r
4961                 {\r
4962                         // get blogs fot which member has admin rights\r
4963                         $adminblogs = $member->getAdminBlogs();\r
4964                         $failed = 0;\r
4965                         foreach ($adminblogs as $blogje)\r
4966                         {\r
4967                                 if ( !Ban::addBan($blogje, $iprange, $reason) )\r
4968                                 {\r
4969                                         $failed = 1;\r
4970                                 }\r
4971                         }\r
4972                         if ( $failed )\r
4973                         {\r
4974                                 self::error(_ERROR_ADDBAN);\r
4975                         }\r
4976                 }\r
4977                 self::action_banlist();\r
4978                 return;\r
4979         }\r
4980         \r
4981         /**\r
4982          * Admin::action_clearactionlog()\r
4983          * \r
4984          * @param       void\r
4985          * @return      void\r
4986          */\r
4987         static private function action_clearactionlog()\r
4988         {\r
4989                 global $member;\r
4990                 \r
4991                 $member->isAdmin() or self::disallow();\r
4992                 \r
4993                 ActionLog::clear();\r
4994                 \r
4995                 self::action_manage(_MSG_ACTIONLOGCLEARED);\r
4996                 return;\r
4997         }\r
4998         \r
4999         /**\r
5000          * Admin::action_backupoverview()\r
5001          * \r
5002          * @param       void\r
5003          * @return      void\r
5004          */\r
5005         static private function action_backupoverview()\r
5006         {\r
5007                 global $member, $manager;\r
5008                 \r
5009                 $member->isAdmin() or self::disallow();\r
5010                 \r
5011                 self::$skin->parse('backupoverview');\r
5012                 return;\r
5013         }\r
5014 \r
5015         /**\r
5016          * Admin::action_backupcreate()\r
5017          * create file for backup\r
5018          * \r
5019          * @param               void\r
5020          * @return      void\r
5021          * \r
5022          */\r
5023         static private function action_backupcreate()\r
5024         {\r
5025                 global $member, $DIR_LIBS;\r
5026                 \r
5027                 $member->isAdmin() or self::disallow();\r
5028                 \r
5029                 // use compression ?\r
5030                 $useGzip = (integer) postVar('gzip');\r
5031                 \r
5032                 include($DIR_LIBS . 'backup.php');\r
5033                 \r
5034                 // try to extend time limit\r
5035                 // (creating/restoring dumps might take a while)\r
5036                 @set_time_limit(1200);\r
5037                 \r
5038                 Backup::do_backup($useGzip);\r
5039                 exit;\r
5040         }\r
5041         \r
5042         /**\r
5043          * Admin::action_backuprestore()\r
5044          * restoring from uploaded file\r
5045          * \r
5046          * @param               void\r
5047          * @return      void\r
5048          */\r
5049         static private function action_backuprestore()\r
5050         {\r
5051                 global $member, $DIR_LIBS;\r
5052                 \r
5053                 $member->isAdmin() or self::disallow();\r
5054                 \r
5055                 if ( intPostVar('letsgo') != 1 )\r
5056                 {\r
5057                         self::error(_ERROR_BACKUP_NOTSURE);\r
5058                 }\r
5059                 \r
5060                 include($DIR_LIBS . 'backup.php');\r
5061                 \r
5062                 // try to extend time limit\r
5063                 // (creating/restoring dumps might take a while)\r
5064                 @set_time_limit(1200);\r
5065                 \r
5066                 $message = Backup::do_restore();\r
5067                 if ( $message != '' )\r
5068                 {\r
5069                         self::error($message);\r
5070                 }\r
5071                 self::$skin->parse('backuprestore');\r
5072                 return;\r
5073         }\r
5074         \r
5075         /**\r
5076          * Admin::action_pluginlist()\r
5077          * output the list of installed plugins\r
5078          * \r
5079          * @param       void\r
5080          * @return      void\r
5081          * \r
5082          */\r
5083         static private function action_pluginlist()\r
5084         {\r
5085                 global $DIR_PLUGINS, $member, $manager;\r
5086                 \r
5087                 // check if allowed\r
5088                 $member->isAdmin() or self::disallow();\r
5089                 \r
5090                 self::$skin->parse('pluginlist');\r
5091                 return;\r
5092         }\r
5093         \r
5094         /**\r
5095          * Admin::action_pluginhelp()\r
5096          * \r
5097          * @param       void\r
5098          * @return      void\r
5099          */\r
5100         static private function action_pluginhelp()\r
5101         {\r
5102                 global $member, $manager, $DIR_PLUGINS, $CONF;\r
5103                 \r
5104                 // check if allowed\r
5105                 $member->isAdmin() or self::disallow();\r
5106                 \r
5107                 $plugid = intGetVar('plugid');\r
5108                 \r
5109                 if ( !$manager->pidInstalled($plugid) )\r
5110                 {\r
5111                         self::error(_ERROR_NOSUCHPLUGIN);\r
5112                 }\r
5113                 \r
5114                 self::$skin->parse('pluginhelp');\r
5115                 return;\r
5116         }\r
5117         \r
5118         /**\r
5119          * Admin::action_pluginadd()\r
5120          * \r
5121          * @param       Void\r
5122          * @return      Void\r
5123          * \r
5124          */\r
5125         static private function action_pluginadd()\r
5126         {\r
5127                 global $member, $manager, $DIR_PLUGINS;\r
5128                 \r
5129                 // check if allowed\r
5130                 $member->isAdmin() or self::disallow();\r
5131                 \r
5132                 $name = postVar('filename');\r
5133                 \r
5134                 if ( $manager->pluginInstalled($name) )\r
5135                 {\r
5136                         self::error(_ERROR_DUPPLUGIN);\r
5137                 }\r
5138                 \r
5139                 if ( !checkPlugin($name) )\r
5140                 {\r
5141                         self::error(_ERROR_PLUGFILEERROR . ' (' . Entity::hsc($name) . ')');\r
5142                 }\r
5143                 \r
5144                 // get number of currently installed plugins\r
5145                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5146                 $numCurrent = $res->rowCount();\r
5147                 \r
5148                 // plugin will be added as last one in the list\r
5149                 $newOrder = $numCurrent + 1;\r
5150                 \r
5151                 $data = array('file' => &$name);\r
5152                 $manager->notify('PreAddPlugin', $data);\r
5153                 \r
5154                 // do this before calling getPlugin (in case the plugin id is used there)\r
5155                 $query = "INSERT INTO %s (porder, pfile) VALUES (%d, %s);";\r
5156                 $query = sprintf($query, sql_table('plugin'), (integer) $newOrder, DB::quoteValue($name));\r
5157                 DB::execute($query);\r
5158                 $iPid = DB::getInsertId();\r
5159                 \r
5160                 $manager->clearCachedInfo('installedPlugins');\r
5161                 \r
5162                 // Load the plugin for condition checking and instalation\r
5163                 $plugin =& $manager->getPlugin($name);\r
5164                 \r
5165                 // check if it got loaded (could have failed)\r
5166                 if ( !$plugin )\r
5167                 {\r
5168                         $query = "DELETE FROM %s WHERE pid=%d;";\r
5169                         $query = sprintf($query, sql_table('plugin'), (integer) $iPid);\r
5170                         \r
5171                         DB::execute($query);\r
5172                         \r
5173                         $manager->clearCachedInfo('installedPlugins');\r
5174                         self::error(_ERROR_PLUGIN_LOAD);\r
5175                 }\r
5176                 \r
5177                 // check if plugin needs a newer Nucleus version\r
5178                 if ( getNucleusVersion() < $plugin->getMinNucleusVersion() )\r
5179                 {\r
5180                         // uninstall plugin again...\r
5181                         self::deleteOnePlugin($plugin->getID());\r
5182                         \r
5183                         // ...and show error\r
5184                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc($plugin->getMinNucleusVersion()));\r
5185                 }\r
5186                 \r
5187                 // check if plugin needs a newer Nucleus version\r
5188                 if ( (getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()) )\r
5189                 {\r
5190                         // uninstall plugin again...\r
5191                         self::deleteOnePlugin($plugin->getID());\r
5192                         \r
5193                         // ...and show error\r
5194                         self::error(_ERROR_NUCLEUSVERSIONREQ . Entity::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );\r
5195                 }\r
5196                 \r
5197                 $pluginList = $plugin->getPluginDep();\r
5198                 foreach ( $pluginList as $pluginName )\r
5199                 {\r
5200                         $res = DB::getResult('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile=' . DB::quoteValue($pluginName));\r
5201                         if ($res->rowCount() == 0)\r
5202                         {\r
5203                                 // uninstall plugin again...\r
5204                                 self::deleteOnePlugin($plugin->getID());\r
5205                                 self::error(sprintf(_ERROR_INSREQPLUGIN, Entity::hsc($pluginName)));\r
5206                         }\r
5207                 }\r
5208                 \r
5209                 // call the install method of the plugin\r
5210                 $plugin->install();\r
5211                 \r
5212                 $data = array('plugin' => &$plugin);\r
5213                 $manager->notify('PostAddPlugin', $data);\r
5214                 \r
5215                 // update all events\r
5216                 self::action_pluginupdate();\r
5217                 return;\r
5218         }\r
5219         \r
5220         /**\r
5221          * ADMIN:action_pluginupdate():\r
5222          * \r
5223          * @param       Void\r
5224          * @return      Void\r
5225          * \r
5226          */\r
5227         static private function action_pluginupdate()\r
5228         {\r
5229                 global $member, $manager, $CONF;\r
5230                 \r
5231                 // check if allowed\r
5232                 $member->isAdmin() or self::disallow();\r
5233                 \r
5234                 // delete everything from plugin_events\r
5235                 DB::execute('DELETE FROM '.sql_table('plugin_event'));\r
5236                 \r
5237                 // loop over all installed plugins\r
5238                 $res = DB::getResult('SELECT pid, pfile FROM '.sql_table('plugin'));\r
5239                 foreach ( $res as $row )\r
5240                 {\r
5241                         $pid  =  $row['pid'];\r
5242                         $plug =& $manager->getPlugin($row['pfile']);\r
5243                         if ( $plug )\r
5244                         {\r
5245                                 $eventList = $plug->getEventList();\r
5246                                 foreach ( $eventList as $eventName )\r
5247                                 {\r
5248                                         $query = "INSERT INTO %s (pid, event) VALUES (%d, %s)";\r
5249                                         $query = sprintf($query, sql_table('plugin_event'), (integer) $pid, DB::quoteValue($eventName));\r
5250                                         DB::execute($query);\r
5251                                 }\r
5252                         }\r
5253                 }\r
5254                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5255                 return;\r
5256         }\r
5257         \r
5258         /**\r
5259          * Admin::action_plugindelete()\r
5260          * \r
5261          * @param       void\r
5262          * @return      void\r
5263          */\r
5264         static private function action_plugindelete()\r
5265         {\r
5266                 global $member, $manager;\r
5267                 \r
5268                 // check if allowed\r
5269                 $member->isAdmin() or self::disallow();\r
5270                 \r
5271                 $pid = intGetVar('plugid');\r
5272                 \r
5273                 if ( !$manager->pidInstalled($pid) )\r
5274                 {\r
5275                         self::error(_ERROR_NOSUCHPLUGIN);\r
5276                 }\r
5277                 \r
5278                 self::$skin->parse('plugindelete');\r
5279                 return;\r
5280         }\r
5281 \r
5282         /**\r
5283          * Admin::action_plugindeleteconfirm()\r
5284          * \r
5285          * @param       void\r
5286          * @return      void\r
5287          */\r
5288         static private function action_plugindeleteconfirm()\r
5289         {\r
5290                 global $member, $manager, $CONF;\r
5291                 \r
5292                 // check if allowed\r
5293                 $member->isAdmin() or self::disallow();\r
5294                 \r
5295                 $pid = intPostVar('plugid');\r
5296                 \r
5297                 $error = self::deleteOnePlugin($pid, 1);\r
5298                 if ( $error )\r
5299                 {\r
5300                         self::error($error);\r
5301                 }\r
5302                 \r
5303                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5304                 return;\r
5305         }\r
5306         \r
5307         /**\r
5308          * Admin::\r
5309          * \r
5310          * @param       void\r
5311          * @return      void\r
5312          */\r
5313         static public function deleteOnePlugin($pid, $callUninstall = 0)\r
5314         {\r
5315                 global $manager;\r
5316                 \r
5317                 $pid = intval($pid);\r
5318                 \r
5319                 if ( !$manager->pidInstalled($pid) )\r
5320                 {\r
5321                         return _ERROR_NOSUCHPLUGIN;\r
5322                 }\r
5323                 \r
5324                 $query = "SELECT pfile as result FROM %s WHERE pid=%d;";\r
5325                 $query = sprintf($query, sql_table('plugin'), (integer) $pid);\r
5326                 $name = DB::getValue($query);\r
5327                 \r
5328                 // check dependency before delete\r
5329                 $res = DB::getResult('SELECT pfile FROM ' . sql_table('plugin'));\r
5330                 foreach ( $res as $row )\r
5331                 {\r
5332                         $plug =& $manager->getPlugin($row['pfile']);\r
5333                         if ( $plug )\r
5334                         {\r
5335                                 $depList = $plug->getPluginDep();\r
5336                                 foreach ( $depList as $depName )\r
5337                                 {\r
5338                                         if ( $name == $depName )\r
5339                                         {\r
5340                                                 return sprintf(_ERROR_DELREQPLUGIN, $row['pfile']);\r
5341                                         }\r
5342                                 }\r
5343                         }\r
5344                 }\r
5345                 \r
5346                 $data = array('plugid' => $pid);\r
5347                 $manager->notify('PreDeletePlugin', $data);\r
5348                 \r
5349                 // call the unInstall method of the plugin\r
5350                 if ( $callUninstall )\r
5351                 {\r
5352                         $plugin =& $manager->getPlugin($name);\r
5353                         if ( $plugin )\r
5354                         {\r
5355                                 $plugin->unInstall();\r
5356                         }\r
5357                 }\r
5358                 \r
5359                 // delete all subscriptions\r
5360                 DB::execute('DELETE FROM ' . sql_table('plugin_event') . ' WHERE pid=' . $pid);\r
5361                 \r
5362                 // delete all options\r
5363                 // get OIDs from plugin_option_desc\r
5364                 $res = DB::getResult('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5365                 $aOIDs = array();\r
5366                 foreach ( $res as $row )\r
5367                 {\r
5368                         array_push($aOIDs, $row['oid']);\r
5369                 }\r
5370                 \r
5371                 // delete from plugin_option and plugin_option_desc\r
5372                 DB::execute('DELETE FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);\r
5373                 if (count($aOIDs) > 0)\r
5374                 {\r
5375                         DB::execute('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid in (' . implode(',', $aOIDs) . ')');\r
5376                 }\r
5377                 \r
5378                 // update order numbers\r
5379                 $res = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5380                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=(porder - 1) WHERE porder>' . $res);\r
5381                 \r
5382                 // delete row\r
5383                 DB::execute('DELETE FROM ' . sql_table('plugin') . ' WHERE pid=' . $pid);\r
5384                 \r
5385                 $manager->clearCachedInfo('installedPlugins');\r
5386                 $data = array('plugid' => $pid);\r
5387                 $manager->notify('PostDeletePlugin', $data);\r
5388                 \r
5389                 return '';\r
5390         }\r
5391         \r
5392         /**\r
5393          * Admin::action_pluginup()\r
5394          * \r
5395          * @param       void\r
5396          * @return      void\r
5397          */\r
5398         static private function action_pluginup()\r
5399         {\r
5400                 global $member, $manager, $CONF;\r
5401                 \r
5402                 // check if allowed\r
5403                 $member->isAdmin() or self::disallow();\r
5404                 \r
5405                 $plugid = intGetVar('plugid');\r
5406                 \r
5407                 if ( !$manager->pidInstalled($plugid) )\r
5408                 {\r
5409                         self::error(_ERROR_NOSUCHPLUGIN);\r
5410                 }\r
5411                 \r
5412                 // 1. get old order number\r
5413                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5414                 \r
5415                 // 2. calculate new order number\r
5416                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;\r
5417                 \r
5418                 // 3. update plug numbers\r
5419                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5420                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5421                 \r
5422                 //self::action_pluginlist();\r
5423                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5424                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5425                 return;\r
5426         }\r
5427         \r
5428         /**\r
5429          * Admin::action_plugindown()\r
5430          * \r
5431          * @param       void\r
5432          * @return      void\r
5433          */\r
5434         static private function action_plugindown()\r
5435         {\r
5436                 global $member, $manager, $CONF;\r
5437                 \r
5438                 // check if allowed\r
5439                 $member->isAdmin() or self::disallow();\r
5440                 \r
5441                 $plugid = intGetVar('plugid');\r
5442                 if ( !$manager->pidInstalled($plugid) )\r
5443                 {\r
5444                         self::error(_ERROR_NOSUCHPLUGIN);\r
5445                 }\r
5446                 \r
5447                 // 1. get old order number\r
5448                 $oldOrder = DB::getValue('SELECT porder FROM ' . sql_table('plugin') . ' WHERE pid=' . $plugid);\r
5449                 \r
5450                 $res = DB::getResult('SELECT * FROM ' . sql_table('plugin'));\r
5451                 $maxOrder = $res->rowCount();\r
5452                 \r
5453                 // 2. calculate new order number\r
5454                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;\r
5455                 \r
5456                 // 3. update plug numbers\r
5457                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $oldOrder . ' WHERE porder=' . $newOrder);\r
5458                 DB::execute('UPDATE ' . sql_table('plugin') . ' SET porder=' . $newOrder . ' WHERE pid=' . $plugid);\r
5459                 \r
5460                 //self::action_pluginlist();\r
5461                 // To avoid showing ticket in the URL, redirect to pluginlist, instead.\r
5462                 redirect($CONF['AdminURL'] . '?action=pluginlist');\r
5463                 return;\r
5464         }\r
5465         \r
5466         /**\r
5467          * Admin::action_pluginoptions()\r
5468          * \r
5469          * Output Plugin option page\r
5470          * \r
5471          * @access      public\r
5472          * @param       string $message message when fallbacked\r
5473          * @return      void\r
5474          * \r
5475          */\r
5476         static private function action_pluginoptions($message = '')\r
5477         {\r
5478                 global $member, $manager;\r
5479                 \r
5480                 // check if allowed\r
5481                 $member->isAdmin() or self::disallow();\r
5482                 \r
5483                 $pid = intRequestVar('plugid');\r
5484                 if ( !$manager->pidInstalled($pid) )\r
5485                 {\r
5486                         self::error(_ERROR_NOSUCHPLUGIN);\r
5487                 }\r
5488                 \r
5489                 if ( isset($message) )\r
5490                 {\r
5491                         self::$headMess = $message;\r
5492                 }\r
5493                 $plugname       = $manager->getPluginNameFromPid($pid);\r
5494                 $plugin         = $manager->getPlugin($plugname);\r
5495                 Admin::$extrahead .= "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";\r
5496                 \r
5497                 self::$skin->parse('pluginoptions');\r
5498                 return;\r
5499         }\r
5500         \r
5501         /**\r
5502          * Admin::action_pluginoptionsupdate()\r
5503          * \r
5504          * Update plugin options and fallback to plugin option page\r
5505          * \r
5506          * @access      public\r
5507          * @param       void\r
5508          * @return      void\r
5509          */\r
5510         static private function action_pluginoptionsupdate()\r
5511         {\r
5512                 global $member, $manager;\r
5513                 \r
5514                 // check if allowed\r
5515                 $member->isAdmin() or self::disallow();\r
5516                 \r
5517                 $pid = intRequestVar('plugid');\r
5518                 \r
5519                 if ( !$manager->pidInstalled($pid) )\r
5520                 {\r
5521                         self::error(_ERROR_NOSUCHPLUGIN);\r
5522                 }\r
5523                 \r
5524                 $aOptions = requestArray('plugoption');\r
5525                 NucleusPlugin::apply_plugin_options($aOptions);\r
5526                 \r
5527                 $data = array(\r
5528                         'context'       => 'global',\r
5529                         'plugid'        => $pid\r
5530                 );\r
5531                 $manager->notify('PostPluginOptionsUpdate', $data);\r
5532                 \r
5533                 self::action_pluginoptions(_PLUGS_OPTIONS_UPDATED);\r
5534                 return;\r
5535         }\r
5536         \r
5537         /**\r
5538          * Admin::action_parseSpecialskin()\r
5539          * \r
5540          * @param       void\r
5541          * @return      void\r
5542          */\r
5543         static private function action_parseSpecialskin()\r
5544         {\r
5545                 self::$skin->parse(self::$action);\r
5546                 return;\r
5547         }\r
5548         \r
5549         /**\r
5550          * Admin::getAdminskinIDFromName()\r
5551          * \r
5552          * @param       string  $skinname       name of skin\r
5553          * @return      integer ID for skin\r
5554          */\r
5555         static private function getAdminskinIDFromName($skinname)\r
5556         {\r
5557                 $query          = "SELECT 'sdnumber' as result FROM %s WHERE sdname = %s;";\r
5558                 $query          = sprintf($query, sql_table('skin_desc'), DB::quoteValue($skinname));\r
5559                 $admnSknID      = DB::getValue($query);\r
5560                 return (integer) $adminSkinID;\r
5561         }\r
5562         \r
5563         /**\r
5564          * Admin::getAdminskinNameFromID()\r
5565          * \r
5566          * @param       integer $skinid ID for skin\r
5567          * @return      integer ID for skin\r
5568          */\r
5569         static private function getAdminskinNameFromID($skinid)\r
5570         {\r
5571                 $query          = "SELECT sdname as result FROM %s WHERE sdnumber = %d;";\r
5572                 $query          = sprintf($query, sql_table('skin_desc'), (integer) $skinid);\r
5573                 $admnSknID      = DB::getValue($query);\r
5574                 return (integer) $adminSkinID;\r
5575         }\r
5576         \r
5577         /**\r
5578          * Admin::getAdminextrahead()\r
5579          */\r
5580         static public function getAdminextrahead()\r
5581         {\r
5582                 return self::$extrahead;\r
5583         }\r
5584         \r
5585         /**\r
5586          * Admin::getAdminpassvar()\r
5587          */\r
5588         static public function getAdminpassvar()\r
5589         {\r
5590                 return self::$passvar;\r
5591         }\r
5592         \r
5593         /**\r
5594          * Admin::getAdminAction()\r
5595          */\r
5596         static public function getAdminAction()\r
5597         {\r
5598                 return self::$action;\r
5599         }\r
5600         \r
5601         /**\r
5602          * Admin::getAdminaOption()\r
5603          */\r
5604         static public function getAdminaOption()\r
5605         {\r
5606                 return self::$aOptions;\r
5607         }\r
5608         \r
5609         /**\r
5610          * Admin::action_importAdmin()\r
5611          * \r
5612          * @param       void\r
5613          * @return      void\r
5614          */\r
5615         static private function action_importAdmin()\r
5616         {\r
5617                 global $DIR_ADMINSKINS, $action;\r
5618                 if ( $action == 'adminskinieimport' )\r
5619                 {\r
5620                         self::doAdminskinimport();\r
5621                 }\r
5622                 $skn = array();\r
5623                 if ( $action == 'showlogin' )\r
5624                 {\r
5625                         $skinName = 'showlogin';\r
5626                         $actnName = 'showlogin';\r
5627                 }\r
5628                 else\r
5629                 {\r
5630                         $skinName = 'defaultimporter';\r
5631                         $actnName = 'importAdmin';\r
5632                 }\r
5633                 \r
5634                 /* TODO: why??? */\r
5635                 $contents                               = file_get_contents($DIR_ADMINSKINS . $skinName . '.skn');\r
5636                 $skn['id']                              = 0;\r
5637                 $skn['description']             = $skinName;\r
5638                 $skn['contentType']             = 'importAdmin';\r
5639                 $skn['includeMode']             = 'normal';\r
5640                 $skn['includePrefix']   = '';\r
5641                 $skn['name']                    = 'defaultinporter';\r
5642                 \r
5643                 self::$skin                             = (object) $skn;\r
5644                 $handler = new AdminActions($actnName, self::$skin, $this);\r
5645                 \r
5646                 $parser = new PARSER($handler);\r
5647                 $parser->setSkin(self::$skin);\r
5648                 $parser->parse($contents);\r
5649                 \r
5650                 return;\r
5651         }\r
5652         \r
5653         /**\r
5654          * Admin::doAdminskinimport()\r
5655          * \r
5656          * @param       void\r
5657          * @return      void\r
5658          */\r
5659         static private function doAdminskinimport()\r
5660         {\r
5661                 global $DIR_LIBS, $DIR_ADMINSKINS, $CONF, $member;\r
5662                 \r
5663                 $member->isAdmin() or self::disallow();\r
5664                 \r
5665                 include_once($DIR_LIBS . 'Skinie.php');\r
5666                 $skinFileRaw    = postVar('skinfile');\r
5667                 $mode                   = postVar('mode');\r
5668                 $allowOverwrite = intPostVar('overwrite');\r
5669                 \r
5670                 if ( $mode == 'file' )\r
5671                 {\r
5672                         $skinFile = $DIR_ADMINSKINS . $skinFileRaw . '/skinbackup.xml';\r
5673                 }\r
5674                 else\r
5675                 {\r
5676                         $skinFile = $skinFileRaw;\r
5677                 }\r
5678                 \r
5679                 $importer       = new SKINIMPORT();\r
5680                 $error          = $importer->readFile($skinFile);\r
5681                 if ( $error )\r
5682                 {\r
5683                         self::error($error);\r
5684                 }\r
5685                 $error = $importer->writeToDatabase($allowOverwrite);\r
5686                 if ( $error )\r
5687                 {\r
5688                         self::error($error);\r
5689                 }\r
5690                 \r
5691                 $_REQUEST['skininfo']   = $importer->getInfo();\r
5692                 $_REQUEST['skinnames']  = $importer->getSkinNames();\r
5693                 $_REQUEST['tpltnames']  = $importer->getTemplateNames();\r
5694                 \r
5695                 header('Location: ' . $CONF['AdminURL']);\r
5696                 exit;\r
5697         }\r
5698 }\r