nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2009 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2009 The Nucleus Group
  17  * @version $Id: ADMIN.php 1661 2012-02-12 11:55:39Z sakamocchi $
  18
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN
  28 {
  29         private $xml_version_info = '1.0';
  30         private $formal_public_identifier = '-//W3C//DTD XHTML 1.0 Strict//EN';
  31         private $system_identifier = 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd';
  32         private $xhtml_namespace = 'http://www.w3.org/1999/xhtml';
  33
  34     /**
  35      * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  36      */
  37     var $action;
  38
  39     /**
  40      * Class constructor
  41      */
  42     function ADMIN() {
  43
  44     }
  45
  46     /**
  47      * Executes an action
  48      *
  49      * @param string $action action to be performed
  50      */
  51     function action($action) {
  52         global $CONF, $manager;
  53
  54         // list of action aliases
  55         $alias = array(
  56             'login' => 'overview',
  57             '' => 'overview'
  58         );
  59
  60         if (isset($alias[$action]))
  61             $action = $alias[$action];
  62
  63         $methodName = 'action_' . $action;
  64
  65         $this->action = strtolower($action);
  66
  67         // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  68         // is an action that requires user interaction before something is actually done)
  69         // all safe actions are in this array:
  70         $aActionsNotToCheck = array(
  71             'showlogin',
  72             'login',
  73             'overview',
  74             'itemlist',
  75             'blogcommentlist',
  76             'bookmarklet',
  77             'blogsettings',
  78             'banlist',
  79             'deleteblog',
  80             'editmembersettings',
  81             'browseownitems',
  82             'browseowncomments',
  83             'createitem',
  84             'itemedit',
  85             'itemmove',
  86             'categoryedit',
  87             'categorydelete',
  88             'manage',
  89             'actionlog',
  90             'settingsedit',
  91             'backupoverview',
  92             'pluginlist',
  93             'createnewlog',
  94             'usermanagement',
  95             'skinoverview',
  96             'templateoverview',
  97             'skinieoverview',
  98             'itemcommentlist',
  99             'commentedit',
 100             'commentdelete',
 101             'banlistnewfromitem',
 102             'banlistdelete',
 103             'itemdelete',
 104             'manageteam',
 105             'teamdelete',
 106             'banlistnew',
 107             'memberedit',
 108             'memberdelete',
 109             'pluginhelp',
 110             'pluginoptions',
 111             'plugindelete',
 112             'skinedittype',
 113             'skinremovetype',
 114             'skindelete',
 115             'skinedit',
 116             'templateedit',
 117             'templatedelete',
 118             'activate',
 119             'systemoverview'
 120         );
 121 /*
 122         // the rest of the actions needs to be checked
 123         $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'activatesetpwd');
 124 */
 125         if (!in_array($this->action, $aActionsNotToCheck))
 126         {
 127             if (!$manager->checkTicket())
 128                 $this->error(_ERROR_BADTICKET);
 129         }
 130
 131         if (method_exists($this, $methodName))
 132             call_user_func(array(&$this, $methodName));
 133         else
 134             $this->error(_BADACTION . ENTITY::hsc(" ($action)"));
 135
 136     }
 137
 138     /**
 139      * @todo document this
 140      */
 141     function action_showlogin() {
 142         global $error;
 143         $this->action_login($error);
 144     }
 145
 146     /**
 147      * @todo document this
 148      */
 149     function action_login($msg = '', $passvars = 1) {
 150         global $member;
 151
 152         // skip to overview when allowed
 153         if ($member->isLoggedIn() && $member->canLogin()) {
 154             $this->action_overview();
 155             exit;
 156         }
 157
 158         $this->pagehead();
 159
 160         echo '<h2>', _LOGIN ,'</h2>';
 161         if ($msg) echo _MESSAGE , ': ', ENTITY::hsc($msg);
 162         ?>
 163
 164         <form action="index.php" method="post"><p>
 165         <?php echo _LOGIN_NAME; ?> <br /><input name="login"  tabindex="10" />
 166         <br />
 167         <?php echo _LOGIN_PASSWORD; ?> <br /><input name="password"  tabindex="20" type="password" />
 168         <br />
 169         <input name="action" value="login" type="hidden" />
 170         <br />
 171         <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 172         <br />
 173         <small>
 174             <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 175             <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 176         </small>
 177         <?php           // pass through vars
 178
 179             $oldaction = postVar('oldaction');
 180             if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 181                 passRequestVars();
 182             }
 183
 184
 185         ?>
 186         </p></form>
 187         <?php       $this->pagefoot();
 188     }
 189
 190
 191     /**
 192      * provides a screen with the overview of the actions available
 193      * @todo document parameter
 194      */
 195     function action_overview($msg = '') {
 196         global $member;
 197
 198         $this->pagehead();
 199
 200         if ($msg)
 201             echo _MESSAGE , ': ', $msg;
 202
 203         /* ---- add items ---- */
 204         echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 205
 206         $showAll = requestVar('showall');
 207
 208         if (($member->isAdmin()) && ($showAll == 'yes')) {
 209             // Super-Admins have access to all blogs! (no add item support though)
 210             $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 211                    . ' FROM ' . sql_table('blog')
 212                    . ' ORDER BY bname';
 213         } else {
 214             $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 215                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 216                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 217                    . ' ORDER BY bname';
 218         }
 219         $template['content'] = 'bloglist';
 220         $template['superadmin'] = $member->isAdmin();
 221         $amount = showlist($query,'table',$template);
 222
 223         if (($showAll != 'yes') && ($member->isAdmin())) {
 224             $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 225             if ($total > $amount)
 226                 echo '<p><a href="index.php?action=overview&amp;showall=yes">' . _OVERVIEW_SHOWALL . '</a></p>';
 227         }
 228
 229         if ($amount == 0)
 230             echo _OVERVIEW_NOBLOGS;
 231
 232         if ($amount != 0) {
 233             echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 234             $query =  'SELECT ititle, inumber, bshortname'
 235                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 236                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 237             $template['content'] = 'draftlist';
 238             $amountdrafts = showlist($query, 'table', $template);
 239             if ($amountdrafts == 0)
 240                 echo _OVERVIEW_NODRAFTS;
 241         }
 242
 243                 if ($amount != 0) {
 244                         $yrBlogs = $member->getAdminBlogs();
 245                         if ($showAll != 'yes') {
 246                                 $admBlogs = array();
 247                                 foreach ($yrBlogs as $value) {
 248                                         if ($member->isBlogAdmin(intval($value))) {
 249                                                 $admBlogs[] = intval($value);
 250                                         }
 251                                 }
 252                                 $yrBlogs = $admBlogs;
 253                         }
 254
 255                         if (count($yrBlogs) > 0) {
 256                                 echo '<h2>' . _OVERVIEW_OTHER_DRAFTS . '</h2>';
 257                                 $query =  'SELECT ititle, inumber, bshortname, mname'
 258                                            . ' FROM ' . sql_table('item'). ', ' . sql_table('blog'). ', ' . sql_table('member')
 259                                            . ' WHERE iauthor<>'.$member->getID().' and iblog IN ('.implode(",",$yrBlogs).') and iblog=bnumber and iauthor=mnumber and idraft=1'
 260                                            . ' ORDER BY iblog ASC';
 261                                 $template['content'] = 'otherdraftlist';
 262                                 $amountdrafts = showlist($query, 'table', $template);
 263                                 if ($amountdrafts == 0)
 264                                         echo _OVERVIEW_NODRAFTS;
 265                         }
 266         }
 267
 268         /* ---- user settings ---- */
 269         echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 270         echo '<ul>';
 271         echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 272         echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 273         echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 274         echo '</ul>';
 275
 276         /* ---- general settings ---- */
 277         if ($member->isAdmin()) {
 278             echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 279             echo '<ul>';
 280             echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 281             echo '</ul>';
 282         }
 283
 284
 285         $this->pagefoot();
 286     }
 287
 288     /**
 289      * Returns a link to a weblog
 290      * @param object BLOG
 291      */
 292     function bloglink(&$blog) {
 293         return '<a href="'.ENTITY::hsc($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. ENTITY::hsc( $blog->getName() ) .'</a>';
 294     }
 295
 296     /**
 297      * @todo document this
 298      */
 299     function action_manage($msg = '') {
 300         global $member;
 301
 302         $member->isAdmin() or $this->disallow();
 303
 304         $this->pagehead();
 305
 306         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 307
 308         if ($msg)
 309             echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 310
 311
 312         echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 313
 314         echo '<ul>';
 315         echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 316         echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 317         echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 318         echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 319         echo '</ul>';
 320
 321         echo '<h2>' . _MANAGE_SKINS . '</h2>';
 322         echo '<ul>';
 323         echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 324         echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 325         echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 326         echo '</ul>';
 327
 328         echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 329         echo '<ul>';
 330         echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 331         echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 332         echo '</ul>';
 333
 334         $this->pagefoot();
 335     }
 336
 337     /**
 338      * @todo document this
 339      */
 340     function action_itemlist($blogid = '') {
 341         global $member, $manager, $CONF;
 342
 343         if ($blogid == '')
 344             $blogid = intRequestVar('blogid');
 345
 346         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 347
 348         $this->pagehead();
 349         $blog =& $manager->getBlog($blogid);
 350
 351         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 352         echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 353
 354         // start index
 355         if (postVar('start'))
 356             $start = intPostVar('start');
 357         else
 358             $start = 0;
 359
 360         if ($start == 0)
 361             echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 362
 363         // amount of items to show
 364         if (postVar('amount'))
 365             $amount = intPostVar('amount');
 366         else {
 367             $amount = intval($CONF['DefaultListSize']);
 368             if ($amount < 1)
 369                 $amount = 10;
 370         }
 371
 372         $search = postVar('search');    // search through items
 373
 374         $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 375                . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 376                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 377
 378         if ($search)
 379             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 380
 381         // non-blog-admins can only edit/delete their own items
 382         if (!$member->blogAdminRights($blogid))
 383             $query .= ' and iauthor=' . $member->getID();
 384
 385
 386         $query .= ' ORDER BY itime DESC'
 387                 . " LIMIT $start,$amount";
 388
 389         $template['content'] = 'itemlist';
 390         $template['now'] = $blog->getCorrectTime(time());
 391
 392         $manager->loadClass("ENCAPSULATE");
 393         $navList = new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 394         $navList->showBatchList('item',$query,'table',$template);
 395
 396
 397         $this->pagefoot();
 398     }
 399
 400     /**
 401      * @todo document this
 402      */
 403     function action_batchitem() {
 404         global $member, $manager;
 405
 406         // check if logged in
 407         $member->isLoggedIn() or $this->disallow();
 408
 409         // more precise check will be done for each performed operation
 410
 411         // get array of itemids from request
 412         $selected = requestIntArray('batch');
 413         $action = requestVar('batchaction');
 414
 415         // Show error when no items were selected
 416         if (!is_array($selected) || sizeof($selected) == 0)
 417             $this->error(_BATCH_NOSELECTION);
 418
 419         // On move: when no destination blog/category chosen, show choice now
 420         $destCatid = intRequestVar('destcatid');
 421         if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 422             $this->batchMoveSelectDestination('item',$selected);
 423
 424         // On delete: check if confirmation has been given
 425         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 426             $this->batchAskDeleteConfirmation('item',$selected);
 427
 428         $this->pagehead();
 429
 430         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 431         echo '<h2>',_BATCH_ITEMS,'</h2>';
 432         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 433         echo '<ul>';
 434
 435
 436         // walk over all itemids and perform action
 437         foreach ($selected as $itemid) {
 438             $itemid = intval($itemid);
 439             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 440
 441             // perform action, display errors if needed
 442             switch($action) {
 443                 case 'delete':
 444                     $error = $this->deleteOneItem($itemid);
 445                     break;
 446                 case 'move':
 447                     $error = $this->moveOneItem($itemid, $destCatid);
 448                     break;
 449                 default:
 450                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 451             }
 452
 453             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 454             echo '</li>';
 455         }
 456
 457         echo '</ul>';
 458         echo '<b>',_BATCH_DONE,'</b>';
 459
 460         $this->pagefoot();
 461
 462
 463     }
 464
 465     /**
 466      * @todo document this
 467      */
 468     function action_batchcomment() {
 469         global $member;
 470
 471         // check if logged in
 472         $member->isLoggedIn() or $this->disallow();
 473
 474         // more precise check will be done for each performed operation
 475
 476         // get array of itemids from request
 477         $selected = requestIntArray('batch');
 478         $action = requestVar('batchaction');
 479
 480         // Show error when no items were selected
 481         if (!is_array($selected) || sizeof($selected) == 0)
 482             $this->error(_BATCH_NOSELECTION);
 483
 484         // On delete: check if confirmation has been given
 485         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 486             $this->batchAskDeleteConfirmation('comment',$selected);
 487
 488         $this->pagehead();
 489
 490         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 491         echo '<h2>',_BATCH_COMMENTS,'</h2>';
 492         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 493         echo '<ul>';
 494
 495         // walk over all itemids and perform action
 496         foreach ($selected as $commentid) {
 497             $commentid = intval($commentid);
 498             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 499
 500             // perform action, display errors if needed
 501             switch($action) {
 502                 case 'delete':
 503                     $error = $this->deleteOneComment($commentid);
 504                     break;
 505                 default:
 506                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 507             }
 508
 509             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 510             echo '</li>';
 511         }
 512
 513         echo '</ul>';
 514         echo '<b>',_BATCH_DONE,'</b>';
 515
 516         $this->pagefoot();
 517
 518
 519     }
 520
 521     /**
 522      * @todo document this
 523      */
 524     function action_batchmember() {
 525         global $member;
 526
 527         // check if logged in and admin
 528         ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 529
 530         // get array of itemids from request
 531         $selected = requestIntArray('batch');
 532         $action = requestVar('batchaction');
 533
 534         // Show error when no members selected
 535         if (!is_array($selected) || sizeof($selected) == 0)
 536             $this->error(_BATCH_NOSELECTION);
 537
 538         // On delete: check if confirmation has been given
 539         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 540             $this->batchAskDeleteConfirmation('member',$selected);
 541
 542         $this->pagehead();
 543
 544         echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 545         echo '<h2>',_BATCH_MEMBERS,'</h2>';
 546         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 547         echo '<ul>';
 548
 549         // walk over all itemids and perform action
 550         foreach ($selected as $memberid) {
 551             $memberid = intval($memberid);
 552             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 553
 554             // perform action, display errors if needed
 555             switch($action) {
 556                 case 'delete':
 557                     $error = $this->deleteOneMember($memberid);
 558                     break;
 559                 case 'setadmin':
 560                     // always succeeds
 561                     sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 562                     $error = '';
 563                     break;
 564                 case 'unsetadmin':
 565                     // there should always remain at least one super-admin
 566                     $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 567                     if (sql_num_rows($r) < 2)
 568                         $error = _ERROR_ATLEASTONEADMIN;
 569                     else
 570                         sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 571                     break;
 572                 default:
 573                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 574             }
 575
 576             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 577             echo '</li>';
 578         }
 579
 580         echo '</ul>';
 581         echo '<b>',_BATCH_DONE,'</b>';
 582
 583         $this->pagefoot();
 584
 585
 586     }
 587
 588     /**
 589      * @todo document this
 590      */
 591     function action_batchteam() {
 592         global $member;
 593
 594         $blogid = intRequestVar('blogid');
 595
 596         // check if logged in and admin
 597         ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 598
 599         // get array of itemids from request
 600         $selected = requestIntArray('batch');
 601         $action = requestVar('batchaction');
 602
 603         // Show error when no members selected
 604         if (!is_array($selected) || sizeof($selected) == 0)
 605             $this->error(_BATCH_NOSELECTION);
 606
 607         // On delete: check if confirmation has been given
 608         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 609             $this->batchAskDeleteConfirmation('team',$selected);
 610
 611         $this->pagehead();
 612
 613         echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 614
 615         echo '<h2>',_BATCH_TEAM,'</h2>';
 616         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 617         echo '<ul>';
 618
 619         // walk over all itemids and perform action
 620         foreach ($selected as $memberid) {
 621             $memberid = intval($memberid);
 622             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 623
 624             // perform action, display errors if needed
 625             switch($action) {
 626                 case 'delete':
 627                     $error = $this->deleteOneTeamMember($blogid, $memberid);
 628                     break;
 629                 case 'setadmin':
 630                     // always succeeds
 631                     sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 632                     $error = '';
 633                     break;
 634                 case 'unsetadmin':
 635                     // there should always remain at least one admin
 636                     $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 637                     if (sql_num_rows($r) < 2)
 638                         $error = _ERROR_ATLEASTONEBLOGADMIN;
 639                     else
 640                         sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 641                     break;
 642                 default:
 643                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 644             }
 645
 646             echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 647             echo '</li>';
 648         }
 649
 650         echo '</ul>';
 651         echo '<b>',_BATCH_DONE,'</b>';
 652
 653         $this->pagefoot();
 654
 655
 656     }
 657
 658     /**
 659      * @todo document this
 660      */
 661     function action_batchcategory() {
 662         global $member, $manager;
 663
 664         // check if logged in
 665         $member->isLoggedIn() or $this->disallow();
 666
 667         // more precise check will be done for each performed operation
 668
 669         // get array of itemids from request
 670         $selected = requestIntArray('batch');
 671         $action = requestVar('batchaction');
 672
 673         // Show error when no items were selected
 674         if (!is_array($selected) || sizeof($selected) == 0)
 675             $this->error(_BATCH_NOSELECTION);
 676
 677         // On move: when no destination blog chosen, show choice now
 678         $destBlogId = intRequestVar('destblogid');
 679         if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 680             $this->batchMoveCategorySelectDestination('category',$selected);
 681
 682         // On delete: check if confirmation has been given
 683         if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 684             $this->batchAskDeleteConfirmation('category',$selected);
 685
 686         $this->pagehead();
 687
 688         echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 689         echo '<h2>',BATCH_CATEGORIES,'</h2>';
 690         echo '<p>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b></p>';
 691         echo '<ul>';
 692
 693         // walk over all itemids and perform action
 694         foreach ($selected as $catid) {
 695             $catid = intval($catid);
 696             echo '<li>',_BATCH_EXECUTING,' <b>',ENTITY::hsc($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 697
 698             // perform action, display errors if needed
 699             switch($action) {
 700                 case 'delete':
 701                     $error = $this->deleteOneCategory($catid);
 702                     break;
 703                 case 'move':
 704                     $error = $this->moveOneCategory($catid, $destBlogId);
 705                     break;
 706                 default:
 707                     $error = _BATCH_UNKNOWN . ENTITY::hsc($action);
 708             }
 709
 710             echo '<b>',($error ? _ERROR . ': '.$error : _BATCH_SUCCESS),'</b>';
 711             echo '</li>';
 712         }
 713
 714         echo '</ul>';
 715         echo '<b>',_BATCH_DONE,'</b>';
 716
 717         $this->pagefoot();
 718
 719     }
 720
 721     /**
 722      * @todo document this
 723      */
 724     function batchMoveSelectDestination($type, $ids) {
 725         global $manager;
 726         $this->pagehead();
 727         ?>
 728         <h2><?php echo _MOVE_TITLE?></h2>
 729         <form method="post" action="index.php"><div>
 730
 731             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 732             <input type="hidden" name="batchaction" value="move" />
 733             <?php
 734                 $manager->addTicketHidden();
 735
 736                 // insert selected item numbers
 737                 $idx = 0;
 738                 foreach ($ids as $id)
 739                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 740
 741                 // show blog/category selection list
 742                 $this->selectBlogCategory('destcatid');
 743
 744             ?>
 745
 746
 747             <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 748
 749         </div></form>
 750         <?php       $this->pagefoot();
 751         exit;
 752     }
 753
 754     /**
 755      * @todo document this
 756      */
 757     function batchMoveCategorySelectDestination($type, $ids) {
 758         global $manager;
 759         $this->pagehead();
 760         ?>
 761         <h2><?php echo _MOVECAT_TITLE?></h2>
 762         <form method="post" action="index.php"><div>
 763
 764             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 765             <input type="hidden" name="batchaction" value="move" />
 766             <?php
 767                 $manager->addTicketHidden();
 768
 769                 // insert selected item numbers
 770                 $idx = 0;
 771                 foreach ($ids as $id)
 772                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 773
 774                 // show blog/category selection list
 775                 $this->selectBlog('destblogid');
 776
 777             ?>
 778
 779
 780             <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 781
 782         </div></form>
 783         <?php       $this->pagefoot();
 784         exit;
 785     }
 786
 787     /**
 788      * @todo document this
 789      */
 790     function batchAskDeleteConfirmation($type, $ids) {
 791         global $manager;
 792
 793         $this->pagehead();
 794         ?>
 795         <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 796         <form method="post" action="index.php"><div>
 797
 798             <input type="hidden" name="action" value="batch<?php echo $type?>" />
 799             <?php $manager->addTicketHidden() ?>
 800             <input type="hidden" name="batchaction" value="delete" />
 801             <input type="hidden" name="confirmation" value="yes" />
 802             <?php               // insert selected item numbers
 803                 $idx = 0;
 804                 foreach ($ids as $id)
 805                     echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 806
 807                 // add hidden vars for team & comment
 808                 if ($type == 'team')
 809                 {
 810                     echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 811                 }
 812                 if ($type == 'comment')
 813                 {
 814                     echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 815                 }
 816
 817             ?>
 818
 819             <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 820
 821         </div></form>
 822         <?php       $this->pagefoot();
 823         exit;
 824     }
 825
 826
 827     /**
 828      * Inserts a HTML select element with choices for all categories to which the current
 829      * member has access
 830      * @see function selectBlog
 831      */
 832     function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 833         ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 834     }
 835
 836     /**
 837      * Inserts a HTML select element with choices for all blogs to which the user has access
 838      *      mode = 'blog' => shows blognames and values are blogids
 839      *      mode = 'category' => show category names and values are catids
 840      *
 841      * @param $iForcedBlogInclude
 842      *      ID of a blog that always needs to be included, without checking if the
 843      *      member is on the blog team (-1 = none)
 844      * @todo document parameters
 845      */
 846     function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 847         global $member, $CONF;
 848
 849         // 0. get IDs of blogs to which member can post items (+ forced blog)
 850         $aBlogIds = array();
 851         if ($iForcedBlogInclude != -1)
 852             $aBlogIds[] = intval($iForcedBlogInclude);
 853
 854         if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 855             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 856         else
 857             $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 858         $rblogids = sql_query($queryBlogs);
 859         while ($o = sql_fetch_object($rblogids))
 860             if ($o->bnumber != $iForcedBlogInclude)
 861                 $aBlogIds[] = intval($o->bnumber);
 862
 863         if (count($aBlogIds) == 0)
 864             return;
 865
 866         echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 867
 868         // 1. select blogs (we'll create optiongroups)
 869         // (only select those blogs that have the user on the team)
 870         $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 871         $blogs = sql_query($queryBlogs);
 872         if ($mode == 'category') {
 873             if (sql_num_rows($blogs) > 1)
 874                 $multipleBlogs = 1;
 875
 876             while ($oBlog = sql_fetch_object($blogs)) {
 877                 if ($multipleBlogs)
 878                     echo '<optgroup label="',ENTITY::hsc($oBlog->bname),'">';
 879
 880                 // show selection to create new category when allowed/wanted
 881                 if ($showNewCat) {
 882                     // check if allowed to do so
 883                     if ($member->blogAdminRights($oBlog->bnumber))
 884                         echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 885                 }
 886
 887                 // 2. for each category in that blog
 888                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 889                 while ($oCat = sql_fetch_object($categories)) {
 890                     if ($oCat->catid == $selected)
 891                         $selectText = ' selected="selected" ';
 892                     else
 893                         $selectText = '';
 894                     echo '<option value="',$oCat->catid,'" ', $selectText,'>',ENTITY::hsc($oCat->cname),'</option>';
 895                 }
 896
 897                 if ($multipleBlogs)
 898                     echo '</optgroup>';
 899             }
 900         } else {
 901             // blog mode
 902             while ($oBlog = sql_fetch_object($blogs)) {
 903                 echo '<option value="',$oBlog->bnumber,'"';
 904                 if ($oBlog->bnumber == $selected)
 905                     echo ' selected="selected"';
 906                 echo'>',ENTITY::hsc($oBlog->bname),'</option>';
 907             }
 908         }
 909         echo '</select>';
 910
 911     }
 912
 913     /**
 914      * @todo document this
 915      */
 916     function action_browseownitems() {
 917         global $member, $manager, $CONF;
 918
 919         $this->pagehead();
 920
 921         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 922         echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 923
 924         // start index
 925         if (postVar('start'))
 926             $start = intPostVar('start');
 927         else
 928             $start = 0;
 929
 930         // amount of items to show
 931         if (postVar('amount'))
 932             $amount = intPostVar('amount');
 933         else {
 934             $amount = intval($CONF['DefaultListSize']);
 935             if ($amount < 1)
 936                 $amount = 10;
 937         }
 938
 939         $search = postVar('search');    // search through items
 940
 941         $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 942                . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 943                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 944
 945         if ($search)
 946             $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 947
 948         $query .= ' ORDER BY itime DESC'
 949                 . " LIMIT $start,$amount";
 950
 951         $template['content'] = 'itemlist';
 952         $template['now'] = time();
 953
 954         $manager->loadClass("ENCAPSULATE");
 955         $navList = new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 956         $navList->showBatchList('item',$query,'table',$template);
 957
 958         $this->pagefoot();
 959
 960     }
 961
 962     /**
 963      * Show all the comments for a given item
 964      * @param int $itemid
 965      */
 966     function action_itemcommentlist($itemid = '') {
 967         global $member, $manager, $CONF;
 968
 969         if ($itemid == '')
 970             $itemid = intRequestVar('itemid');
 971
 972         // only allow if user is allowed to alter item
 973         $member->canAlterItem($itemid) or $this->disallow();
 974
 975         $blogid = getBlogIdFromItemId($itemid);
 976
 977         $this->pagehead();
 978
 979         // start index
 980         if (postVar('start'))
 981             $start = intPostVar('start');
 982         else
 983             $start = 0;
 984
 985         // amount of items to show
 986         if (postVar('amount'))
 987             $amount = intPostVar('amount');
 988         else {
 989             $amount = intval($CONF['DefaultListSize']);
 990             if ($amount < 1)
 991                 $amount = 10;
 992         }
 993
 994         $search = postVar('search');
 995
 996         echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 997         echo '<h2>',_COMMENTS,'</h2>';
 998
 999         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
1000
1001         if ($search)
1002             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1003
1004         $query .= ' ORDER BY ctime ASC'
1005                 . " LIMIT $start,$amount";
1006
1007         $template['content'] = 'commentlist';
1008         $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
1009
1010         $manager->loadClass("ENCAPSULATE");
1011         $navList = new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
1012         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
1013
1014         $this->pagefoot();
1015     }
1016
1017     /**
1018      * Browse own comments
1019      */
1020     function action_browseowncomments() {
1021         global $member, $manager, $CONF;
1022
1023         // start index
1024         if (postVar('start'))
1025             $start = intPostVar('start');
1026         else
1027             $start = 0;
1028
1029         // amount of items to show
1030         if (postVar('amount'))
1031             $amount = intPostVar('amount');
1032         else {
1033             $amount = intval($CONF['DefaultListSize']);
1034             if ($amount < 1)
1035                 $amount = 10;
1036         }
1037
1038         $search = postVar('search');
1039
1040
1041         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
1042
1043         if ($search)
1044             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1045
1046         $query .= ' ORDER BY ctime DESC'
1047                 . " LIMIT $start,$amount";
1048
1049         $this->pagehead();
1050
1051         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1052         echo '<h2>', _COMMENTS_YOUR ,'</h2>';
1053
1054         $template['content'] = 'commentlist';
1055         $template['canAddBan'] = 0; // doesn't make sense to allow banning yourself
1056
1057         $manager->loadClass("ENCAPSULATE");
1058         $navList = new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
1059         $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
1060
1061         $this->pagefoot();
1062     }
1063
1064     /**
1065      * Browse all comments for a weblog
1066      * @param int $blogid
1067      */
1068     function action_blogcommentlist($blogid = '')
1069     {
1070         global $member, $manager, $CONF;
1071
1072         if ($blogid == '')
1073             $blogid = intRequestVar('blogid');
1074         else
1075             $blogid = intval($blogid);
1076
1077         $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
1078
1079         // start index
1080         if (postVar('start'))
1081             $start = intPostVar('start');
1082         else
1083             $start = 0;
1084
1085         // amount of items to show
1086         if (postVar('amount'))
1087             $amount = intPostVar('amount');
1088         else {
1089             $amount = intval($CONF['DefaultListSize']);
1090             if ($amount < 1)
1091                 $amount = 10;
1092         }
1093
1094         $search = postVar('search');        // search through comments
1095
1096
1097         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1098
1099         if ($search != '')
1100             $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
1101
1102
1103         $query .= ' ORDER BY ctime DESC'
1104                 . " LIMIT $start,$amount";
1105
1106
1107         $blog =& $manager->getBlog($blogid);
1108
1109         $this->pagehead();
1110
1111         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1112         echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1113
1114         $template['content'] = 'commentlist';
1115         $template['canAddBan'] = $member->blogAdminRights($blogid);
1116
1117         $manager->loadClass("ENCAPSULATE");
1118         $navList = new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1119         $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1120
1121         $this->pagefoot();
1122     }
1123
1124     /**
1125      * Provide a page to item a new item to the given blog
1126      */
1127     function action_createitem() {
1128         global $member, $manager;
1129
1130         $blogid = intRequestVar('blogid');
1131
1132         // check if allowed
1133         $member->teamRights($blogid) or $this->disallow();
1134
1135         $memberid = $member->getID();
1136
1137         $blog =& $manager->getBlog($blogid);
1138
1139         $this->pagehead();
1140
1141         // generate the add-item form
1142         $formfactory = new PAGEFACTORY($blogid);
1143         $formfactory->createAddForm('admin');
1144
1145         $this->pagefoot();
1146     }
1147
1148     /**
1149      * @todo document this
1150      */
1151     function action_itemedit()
1152         {
1153                 global $member, $manager;
1154
1155                 $itemid = intRequestVar('itemid');
1156
1157                 // only allow if user is allowed to alter item
1158                 $member->canAlterItem($itemid) or $this->disallow();
1159
1160                 $item =& $manager->getItem($itemid, 1, 1);
1161                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1162
1163                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1164
1165                 if ($blog->convertBreaks())
1166                 {
1167                         $item['body'] = removeBreaks($item['body']);
1168                         $item['more'] = removeBreaks($item['more']);
1169                 }
1170
1171                 // form to edit blog items
1172                 $this->pagehead();
1173                 $formfactory = new PAGEFACTORY($blog->getID());
1174                 $formfactory->createEditForm('admin', $item);
1175                 $this->pagefoot();
1176     }
1177
1178     /**
1179      * @todo document this
1180      */
1181     function action_itemupdate() {
1182         global $member, $manager, $CONF;
1183
1184         $itemid = intRequestVar('itemid');
1185         $catid = postVar('catid');
1186
1187         // only allow if user is allowed to alter item
1188         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1189
1190         $actiontype = postVar('actiontype');
1191
1192         // delete actions are handled by itemdelete (which has confirmation)
1193         if ($actiontype == 'delete') {
1194             $this->action_itemdelete();
1195             return;
1196         }
1197
1198         $body   = postVar('body');
1199         $title  = postVar('title');
1200         $more   = postVar('more');
1201         $closed = intPostVar('closed');
1202         $draftid = intPostVar('draftid');
1203
1204         // default action = add now
1205         if (!$actiontype)
1206             $actiontype='addnow';
1207
1208         // create new category if needed
1209         if (strstr($catid,'newcat')) {
1210             // get blogid
1211             list($blogid) = sscanf($catid,"newcat-%d");
1212
1213             // create
1214             $blog =& $manager->getBlog($blogid);
1215             $catid = $blog->createNewCategory();
1216
1217             // show error when sth goes wrong
1218             if (!$catid)
1219                 $this->doError(_ERROR_CATCREATEFAIL);
1220         }
1221
1222         /*
1223             set some variables based on actiontype
1224
1225             actiontypes:
1226                 draft items -> addnow, addfuture, adddraft, delete
1227                 non-draft items -> edit, changedate, delete
1228
1229             variables set:
1230                 $timestamp: set to a nonzero value for future dates or date changes
1231                 $wasdraft: set to 1 when the item used to be a draft item
1232                 $publish: set to 1 when the edited item is not a draft
1233         */
1234         $blogid =  getBlogIDFromItemID($itemid);
1235         $blog   =& $manager->getBlog($blogid);
1236
1237         $wasdrafts = array('adddraft', 'addfuture', 'addnow');
1238         $wasdraft  = in_array($actiontype, $wasdrafts) ? 1 : 0;
1239         $publish   = ($actiontype != 'adddraft' && $actiontype != 'backtodrafts') ? 1 : 0;
1240         if ($actiontype == 'addfuture' || $actiontype == 'changedate') {
1241             $timestamp = mktime(intPostVar('hour'), intPostVar('minutes'), 0, intPostVar('month'), intPostVar('day'), intPostVar('year'));
1242         } else {
1243             $timestamp =0;
1244         }
1245
1246         // edit the item for real
1247         ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1248
1249         $this->updateFuturePosted($blogid);
1250
1251         if ($draftid > 0) {
1252             // delete permission is checked inside ITEM::delete()
1253             ITEM::delete($draftid);
1254         }
1255
1256         // show category edit window when we created a new category
1257         // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1258         if ($catid != intPostVar('catid')) {
1259             $this->action_categoryedit(
1260                 $catid,
1261                 $blog->getID(),
1262                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1263             );
1264         } else {
1265             // TODO: set start item correctly for itemlist
1266             $this->action_itemlist(getBlogIDFromItemID($itemid));
1267         }
1268     }
1269
1270     /**
1271      * @todo document this
1272      */
1273     function action_itemdelete() {
1274         global $member, $manager;
1275
1276         $itemid = intRequestVar('itemid');
1277
1278         // only allow if user is allowed to alter item
1279         $member->canAlterItem($itemid) or $this->disallow();
1280
1281         if (!$manager->existsItem($itemid,1,1))
1282             $this->error(_ERROR_NOSUCHITEM);
1283
1284         $item =& $manager->getItem($itemid,1,1);
1285         $title = ENTITY::hsc(strip_tags($item['title']));
1286         $body = strip_tags($item['body']);
1287         $body = ENTITY::hsc(shorten($body,300,'...'));
1288
1289         $this->pagehead();
1290         ?>
1291             <h2><?php echo _DELETE_CONFIRM?></h2>
1292
1293             <p><?php echo _CONFIRMTXT_ITEM?></p>
1294
1295             <div class="note">
1296                 <b>"<?php echo  $title ?>"</b>
1297                 <br />
1298                 <?php echo $body?>
1299             </div>
1300
1301             <form method="post" action="index.php"><div>
1302                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1303                 <?php $manager->addTicketHidden() ?>
1304                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1305                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1306             </div></form>
1307         <?php
1308         $this->pagefoot();
1309     }
1310
1311     /**
1312      * @todo document this
1313      */
1314     function action_itemdeleteconfirm() {
1315         global $member;
1316
1317         $itemid = intRequestVar('itemid');
1318
1319         // only allow if user is allowed to alter item
1320         $member->canAlterItem($itemid) or $this->disallow();
1321
1322         // get blogid first
1323         $blogid = getBlogIdFromItemId($itemid);
1324
1325         // delete item (note: some checks will be performed twice)
1326         $this->deleteOneItem($itemid);
1327
1328         $this->action_itemlist($blogid);
1329     }
1330
1331     /**
1332      * Deletes one item and returns error if something goes wrong
1333      * @param int $itemid
1334      */
1335     function deleteOneItem($itemid) {
1336         global $member, $manager;
1337
1338         // only allow if user is allowed to alter item (also checks if itemid exists)
1339         if (!$member->canAlterItem($itemid))
1340             return _ERROR_DISALLOWED;
1341
1342         // need to get blogid before the item is deleted
1343         $blogid = getBlogIDFromItemId($itemid);
1344
1345         $manager->loadClass('ITEM');
1346         ITEM::delete($itemid);
1347
1348         // update blog's futureposted
1349         $this->updateFuturePosted($blogid);
1350     }
1351
1352     /**
1353      * Update a blog's future posted flag
1354      * @param int $blogid
1355      */
1356     function updateFuturePosted($blogid) {
1357         global $manager;
1358
1359         $blog =& $manager->getBlog($blogid);
1360         $currenttime = $blog->getCorrectTime(time());
1361         $result = sql_query("SELECT * FROM ".sql_table('item').
1362             " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1363         if (sql_num_rows($result) > 0) {
1364                 $blog->setFuturePost();
1365         }
1366         else {
1367                 $blog->clearFuturePost();
1368         }
1369     }
1370
1371     /**
1372      * @todo document this
1373      */
1374     function action_itemmove() {
1375         global $member, $manager;
1376
1377         $itemid = intRequestVar('itemid');
1378
1379         // only allow if user is allowed to alter item
1380         $member->canAlterItem($itemid) or $this->disallow();
1381
1382         $item =& $manager->getItem($itemid,1,1);
1383
1384         $this->pagehead();
1385         ?>
1386             <h2><?php echo _MOVE_TITLE?></h2>
1387             <form method="post" action="index.php"><div>
1388                 <input type="hidden" name="action" value="itemmoveto" />
1389                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1390
1391                 <?php
1392
1393                     $manager->addTicketHidden();
1394                     $this->selectBlogCategory('catid',$item['catid'],10,1);
1395                 ?>
1396
1397                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1398             </div></form>
1399         <?php
1400         $this->pagefoot();
1401     }
1402
1403     /**
1404      * @todo document this
1405      */
1406     function action_itemmoveto() {
1407         global $member, $manager;
1408
1409         $itemid = intRequestVar('itemid');
1410         $catid = requestVar('catid');
1411
1412         // create new category if needed
1413         if (strstr($catid,'newcat')) {
1414             // get blogid
1415             list($blogid) = sscanf($catid,'newcat-%d');
1416
1417             // create
1418             $blog =& $manager->getBlog($blogid);
1419             $catid = $blog->createNewCategory();
1420
1421             // show error when sth goes wrong
1422             if (!$catid)
1423                 $this->doError(_ERROR_CATCREATEFAIL);
1424         }
1425
1426         // only allow if user is allowed to alter item
1427         $member->canUpdateItem($itemid, $catid) or $this->disallow();
1428
1429         $old_blogid = getBlogIDFromItemId($itemid);
1430
1431         ITEM::move($itemid, $catid);
1432
1433         // set the futurePosted flag on the blog
1434         $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1435
1436         // reset the futurePosted in case the item is moved from one blog to another
1437         $this->updateFuturePosted($old_blogid);
1438
1439         if ($catid != intRequestVar('catid'))
1440             $this->action_categoryedit($catid, $blog->getID());
1441         else
1442             $this->action_itemlist(getBlogIDFromCatID($catid));
1443     }
1444
1445     /**
1446      * Moves one item to a given category (category existance should be checked by caller)
1447      * errors are returned
1448      * @param int $itemid
1449      * @param int $destCatid category ID to which the item will be moved
1450      */
1451     function moveOneItem($itemid, $destCatid) {
1452         global $member;
1453
1454         // only allow if user is allowed to move item
1455         if (!$member->canUpdateItem($itemid, $destCatid))
1456             return _ERROR_DISALLOWED;
1457
1458         ITEM::move($itemid, $destCatid);
1459     }
1460
1461     /**
1462      * Adds a item to the chosen blog
1463      */
1464     function action_additem() {
1465         global $manager, $CONF;
1466
1467         $manager->loadClass('ITEM');
1468
1469         $result = ITEM::createFromRequest();
1470
1471         if ($result['status'] == 'error')
1472             $this->error($result['message']);
1473
1474         $blogid = getBlogIDFromItemID($result['itemid']);
1475         $blog =& $manager->getBlog($blogid);
1476         $btimestamp = $blog->getCorrectTime();
1477         $item       = $manager->getItem(intval($result['itemid']), 1, 1);
1478
1479         if ($result['status'] == 'newcategory') {
1480             $distURI = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=itemList&blogid=' . intval($blogid));
1481             $this->action_categoryedit($result['catid'], $blogid, $distURI);
1482         } else {
1483             $methodName = 'action_itemList';
1484             call_user_func(array(&$this, $methodName), $blogid);
1485         }
1486     }
1487
1488         /**
1489          * Allows to edit previously made comments
1490          **/
1491         function action_commentedit() {
1492
1493                 global $member, $manager;
1494
1495                 $commentid = intRequestVar('commentid');
1496
1497                 $member->canAlterComment($commentid) or $this->disallow();
1498
1499                 $comment = COMMENT::getComment($commentid);
1500
1501                 $manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
1502
1503                 // change <br /> to \n
1504                 $comment['body'] = str_replace('<br />', '', $comment['body']);
1505
1506                 // replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
1507                 /* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
1508
1509         $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#i", "\\1", $comment['body']);
1510
1511         $this->pagehead();
1512
1513         ?>
1514         <h2><?php echo _EDITC_TITLE?></h2>
1515
1516         <form action="index.php" method="post"><div>
1517
1518         <input type="hidden" name="action" value="commentupdate" />
1519         <?php $manager->addTicketHidden(); ?>
1520         <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1521         <table><tr>
1522             <th colspan="2"><?php echo _EDITC_TITLE?></th>
1523         </tr><tr>
1524             <td><?php echo _EDITC_WHO?></td>
1525             <td>
1526             <?php               if ($comment['member'])
1527                     echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1528                 else
1529                     echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1530             ?>
1531             </td>
1532         </tr><tr>
1533             <td><?php echo _EDITC_WHEN?></td>
1534             <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1535         </tr><tr>
1536             <td><?php echo _EDITC_HOST?></td>
1537             <td><?php echo  $comment['host']; ?></td>
1538         </tr>
1539         <tr>
1540             <td><?php echo _EDITC_URL; ?></td>
1541             <td><input type="text" name="url" size="30" tabindex="6" value="<?php echo $comment['userid']; ?>" /></td>
1542         </tr>
1543         <tr>
1544             <td><?php echo _EDITC_EMAIL; ?></td>
1545             <td><input type="text" name="email" size="30" tabindex="8" value="<?php echo $comment['email']; ?>" /></td>
1546         </tr>
1547         <tr>
1548             <td><?php echo _EDITC_TEXT?></td>
1549             <td>
1550                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                   // htmlspecialchars not needed (things should be escaped already)
1551                     echo $comment['body'];
1552                 ?></textarea>
1553             </td>
1554         </tr><tr>
1555             <td><?php echo _EDITC_EDIT?></td>
1556             <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1557         </tr></table>
1558
1559         </div></form>
1560         <?php
1561         $this->pagefoot();
1562     }
1563
1564     /**
1565      * @todo document this
1566      */
1567     function action_commentupdate() {
1568         global $member, $manager;
1569
1570         $commentid = intRequestVar('commentid');
1571
1572         $member->canAlterComment($commentid) or $this->disallow();
1573
1574         $url = postVar('url');
1575         $email = postVar('email');
1576         $body = postVar('body');
1577
1578                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1579                 # original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
1580                 # important note that '\' must be matched with '\\\\' in preg* expressions
1581
1582                 // intercept words that are too long
1583                 if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
1584                 {
1585                         $this->error(_ERROR_COMMENT_LONGWORD);
1586                 }
1587
1588                 // check length
1589                 if (i18n::strlen($body) < 3)
1590                 {
1591                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1592                 }
1593
1594                 if (i18n::strlen($body) > 5000)
1595                 {
1596                         $this->error(_ERROR_COMMENT_TOOLONG);
1597                 }
1598
1599         // prepare body
1600         $body = COMMENT::prepareBody($body);
1601
1602         // call plugins
1603         $manager->notify('PreUpdateComment',array('body' => &$body));
1604
1605         $query = 'UPDATE ' . sql_table('comment')
1606                . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
1607                . " WHERE cnumber = " . $commentid;
1608         sql_query($query);
1609
1610         // get itemid
1611         $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1612         $o = sql_fetch_object($res);
1613         $itemid = $o->citem;
1614
1615         if ($member->canAlterItem($itemid))
1616             $this->action_itemcommentlist($itemid);
1617         else
1618             $this->action_browseowncomments();
1619
1620     }
1621
1622     /**
1623      * @todo document this
1624      */
1625     function action_commentdelete() {
1626         global $member, $manager;
1627
1628         $commentid = intRequestVar('commentid');
1629
1630         $member->canAlterComment($commentid) or $this->disallow();
1631
1632         $comment = COMMENT::getComment($commentid);
1633
1634         $body = strip_tags($comment['body']);
1635         $body = ENTITY::hsc(shorten($body, 300, '...'));
1636
1637         if ($comment['member'])
1638             $author = $comment['member'];
1639         else
1640             $author = $comment['user'];
1641
1642         $this->pagehead();
1643         ?>
1644
1645             <h2><?php echo _DELETE_CONFIRM?></h2>
1646
1647             <p><?php echo _CONFIRMTXT_COMMENT?></p>
1648
1649             <div class="note">
1650             <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1651             <br />
1652             <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1653             </div>
1654
1655             <form method="post" action="index.php"><div>
1656                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1657                 <?php $manager->addTicketHidden() ?>
1658                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1659                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1660             </div></form>
1661         <?php
1662         $this->pagefoot();
1663     }
1664
1665     /**
1666      * @todo document this
1667      */
1668     function action_commentdeleteconfirm() {
1669         global $member;
1670
1671         $commentid = intRequestVar('commentid');
1672
1673         // get item id first
1674         $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1675         $o = sql_fetch_object($res);
1676         $itemid = $o->citem;
1677
1678         $error = $this->deleteOneComment($commentid);
1679         if ($error)
1680             $this->doError($error);
1681
1682         if ($member->canAlterItem($itemid))
1683             $this->action_itemcommentlist($itemid);
1684         else
1685             $this->action_browseowncomments();
1686     }
1687
1688     /**
1689      * @todo document this
1690      */
1691     function deleteOneComment($commentid) {
1692         global $member, $manager;
1693
1694         $commentid = intval($commentid);
1695
1696         if (!$member->canAlterComment($commentid))
1697             return _ERROR_DISALLOWED;
1698
1699         $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1700
1701         // delete the comments associated with the item
1702         $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1703         sql_query($query);
1704
1705         $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1706
1707         return '';
1708     }
1709
1710     /**
1711      * Usermanagement main
1712      */
1713     function action_usermanagement() {
1714         global $member, $manager;
1715
1716         // check if allowed
1717         $member->isAdmin() or $this->disallow();
1718
1719         $this->pagehead();
1720
1721         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1722
1723         echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1724
1725         echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1726
1727         // show list of members with actions
1728         $query =  'SELECT *'
1729                . ' FROM '.sql_table('member');
1730         $template['content'] = 'memberlist';
1731         $template['tabindex'] = 10;
1732
1733         $manager->loadClass("ENCAPSULATE");
1734         $batch = new BATCH('member');
1735         $batch->showlist($query,'table',$template);
1736
1737         echo '<h3>' . _MEMBERS_NEW .'</h3>';
1738         ?>
1739             <form method="post" action="index.php" name="memberedit"><div>
1740
1741             <input type="hidden" name="action" value="memberadd" />
1742             <?php $manager->addTicketHidden() ?>
1743
1744             <table>
1745             <tr>
1746                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1747             </tr><tr>
1748                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1749                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1750                 </td>
1751                 <td><input tabindex="10010" name="name" size="32" maxlength="32" /></td>
1752             </tr><tr>
1753                 <td><?php echo _MEMBERS_REALNAME?></td>
1754                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1755             </tr><tr>
1756                 <td><?php echo _MEMBERS_PWD?></td>
1757                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1758             </tr><tr>
1759                 <td><?php echo _MEMBERS_REPPWD?></td>
1760                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1761             </tr><tr>
1762                 <td><?php echo _MEMBERS_EMAIL?></td>
1763                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1764             </tr><tr>
1765                 <td><?php echo _MEMBERS_URL?></td>
1766                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1767             </tr><tr>
1768                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1769                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1770             </tr><tr>
1771                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1772                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1773             </tr><tr>
1774                 <td><?php echo _MEMBERS_NOTES?></td>
1775                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1776             </tr><tr>
1777                 <td><?php echo _MEMBERS_NEW?></td>
1778                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1779             </tr></table>
1780
1781             </div></form>
1782         <?php
1783         $this->pagefoot();
1784     }
1785
1786     /**
1787      * Edit member settings
1788      */
1789     function action_memberedit() {
1790         $this->action_editmembersettings(intRequestVar('memberid'));
1791     }
1792
1793         /**
1794          * @todo document this
1795          */
1796         function action_editmembersettings($memberid = '') {
1797                 global $member, $manager, $CONF;
1798
1799                 if ($memberid == '')
1800                 {
1801                         $memberid = $member->getID();
1802                 }
1803
1804                 // check if allowed
1805                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1806
1807                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1808                 $this->pagehead($extrahead);
1809
1810                 // show message to go back to member overview (only for admins)
1811                 if ($member->isAdmin())
1812                 {
1813                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1814                 }
1815                 else
1816                 {
1817                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1818                 }
1819                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1820
1821                 $mem = MEMBER::createFromID($memberid);
1822                 ?>
1823                 <form method="post" action="index.php" name="memberedit"><div>
1824
1825                 <input type="hidden" name="action" value="changemembersettings" />
1826                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1827                 <?php $manager->addTicketHidden() ?>
1828
1829                 <table><tr>
1830                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1831                 </tr><tr>
1832                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1833                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1834                         </td>
1835                         <td>
1836                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1837                                 <input name="name" tabindex="10" maxlength="32" size="32" value="<?php echo  ENTITY::hsc($mem->getDisplayName()); ?>" />
1838                         <?php } else {
1839                                 echo ENTITY::hsc($member->getDisplayName());
1840                            }
1841                         ?>
1842                         </td>
1843                 </tr><tr>
1844                         <td><?php echo _MEMBERS_REALNAME?></td>
1845                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  ENTITY::hsc($mem->getRealName()); ?>" /></td>
1846                 </tr><tr>
1847                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1848                         <td><?php echo _MEMBERS_PWD?></td>
1849                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1850                 </tr><tr>
1851                         <td><?php echo _MEMBERS_REPPWD?></td>
1852                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1853                 <?php } ?>
1854                 </tr><tr>
1855                         <td><?php echo _MEMBERS_EMAIL?>
1856                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1857                         </td>
1858                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($mem->getEmail()); ?>" /></td>
1859                 </tr><tr>
1860                         <td><?php echo _MEMBERS_URL?></td>
1861                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getURL()); ?>" /></td>
1862                 <?php // only allow to change this by super-admins
1863                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1864                    if ($member->isAdmin()) {
1865                 ?>
1866                         </tr><tr>
1867                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1868                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1869                         </tr><tr>
1870                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1871                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1872                 <?php } ?>
1873                 </tr><tr>
1874                         <td><?php echo _MEMBERS_NOTES?></td>
1875                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($mem->getNotes()); ?>" /></td>
1876                 </tr><tr>
1877                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1878                         </td>
1879                         <td>
1880
1881                                 <select name="deflang" tabindex="85">
1882                                 <?php
1883                                 $locales = i18n::get_available_locale_list();
1884                                 if ( !$mem->getLocale() || !in_array($mem->getLocale(), $locales) )
1885                                 {
1886                                         echo "<option value=\"\" selected=\"selected\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1887                                 }
1888                                 else
1889                                 {
1890                                         echo "<option value=\"\">" . ENTITY::hsc(_MEMBERS_USESITELANG) . "</option>\n";
1891                                 }
1892
1893                                 foreach( $locales as $locale )
1894                                 {
1895                                         if( $locale == $mem->getLocale() )
1896                                         {
1897                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
1898                                         }
1899                                         else
1900                                         {
1901                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
1902                                         }
1903                                 }
1904                                 ?>
1905                                 </select>
1906
1907                         </td>
1908                 </tr>
1909                 <tr>
1910                         <td><?php echo _MEMBERS_USEAUTOSAVE?> <?php help('autosave'); ?></td>
1911                         <td><?php $this->input_yesno('autosave', $mem->getAutosave(), 87); ?></td>
1912                 </tr>
1913                 <?php
1914                         // plugin options
1915                         $this->_insertPluginOptions('member',$memberid);
1916                 ?>
1917                 <tr>
1918                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1919                 </tr><tr>
1920                         <td><?php echo _MEMBERS_EDIT?></td>
1921                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1922                 </tr></table>
1923
1924                 </div></form>
1925
1926                 <?php
1927                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1928
1929                         $manager->notify(
1930                                 'MemberSettingsFormExtras',
1931                                 array(
1932                                         'member' => &$mem
1933                                 )
1934                         );
1935                 $this->pagefoot();
1936         }
1937
1938     /**
1939      * @todo document this
1940      */
1941     function action_changemembersettings() {
1942         global $member, $CONF, $manager;
1943
1944         $memberid = intRequestVar('memberid');
1945
1946         // check if allowed
1947         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1948
1949         $name           = trim(strip_tags(postVar('name')));
1950         $realname       = trim(strip_tags(postVar('realname')));
1951         $password       = postVar('password');
1952         $repeatpassword = postVar('repeatpassword');
1953         $email          = strip_tags(postVar('email'));
1954         $url            = strip_tags(postVar('url'));
1955
1956                 # replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
1957                 # original eregi: !eregi("^https?://", $url)
1958
1959                 // begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
1960                 if (!preg_match('#^https?://#', $url) )
1961                 {
1962                         $url = 'http://' . $url;
1963                 }
1964
1965         $admin          = postVar('admin');
1966         $canlogin       = postVar('canlogin');
1967         $notes          = strip_tags(postVar('notes'));
1968         $locale        = postVar('deflang');
1969
1970         $mem = MEMBER::createFromID($memberid);
1971
1972         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1973
1974             if (!isValidDisplayName($name))
1975                 $this->error(_ERROR_BADNAME);
1976
1977             if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1978                 $this->error(_ERROR_NICKNAMEINUSE);
1979
1980             if ($password != $repeatpassword)
1981                 $this->error(_ERROR_PASSWORDMISMATCH);
1982
1983             if ($password && (i18n::strlen($password) < 6))
1984                 $this->error(_ERROR_PASSWORDTOOSHORT);
1985
1986             if ($password) {
1987                                 $pwdvalid = true;
1988                                 $pwderror = '';
1989                                 $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
1990                                 if (!$pwdvalid) {
1991                                         $this->error($pwderror);
1992                                 }
1993                         }
1994                 }
1995
1996                 if ( !NOTIFICATION::address_validation($email) )
1997                 {
1998                         $this->error(_ERROR_BADMAILADDRESS);
1999                 }
2000                 if ( !$realname )
2001                 {
2002                         $this->error(_ERROR_REALNAMEMISSING);
2003                 }
2004         if ( ($locale != '') && (!in_array($locale, i18n::get_available_locale_list())) )
2005             $this->error(_ERROR_NOSUCHLANGUAGE);
2006
2007         // check if there will remain at least one site member with both the logon and admin rights
2008         // (check occurs when taking away one of these rights from such a member)
2009         if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
2010              || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
2011            )
2012         {
2013             $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
2014             if (sql_num_rows($r) < 2)
2015                 $this->error(_ERROR_ATLEASTONEADMIN);
2016         }
2017
2018         if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
2019             $mem->setDisplayName($name);
2020             if ($password)
2021                 $mem->setPassword($password);
2022         }
2023
2024         $oldEmail = $mem->getEmail();
2025
2026         $mem->setRealName($realname);
2027         $mem->setEmail($email);
2028         $mem->setURL($url);
2029         $mem->setNotes($notes);
2030         $mem->setLocale($locale);
2031
2032
2033         // only allow super-admins to make changes to the admin status
2034         if ($member->isAdmin()) {
2035             $mem->setAdmin($admin);
2036             $mem->setCanLogin($canlogin);
2037         }
2038
2039         $autosave = postVar ('autosave');
2040         $mem->setAutosave($autosave);
2041
2042         $mem->write();
2043
2044         // store plugin options
2045         $aOptions = requestArray('plugoption');
2046         NucleusPlugin::apply_plugin_options($aOptions);
2047         $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
2048
2049         // if email changed, generate new password
2050         if ($oldEmail != $mem->getEmail())
2051         {
2052             $mem->sendActivationLink('addresschange', $oldEmail);
2053             // logout member
2054             $mem->newCookieKey();
2055
2056             // only log out if the member being edited is the current member.
2057             if ($member->getID() == $memberid)
2058                 $member->logout();
2059             $this->action_login(_MSG_ACTIVATION_SENT, 0);
2060             return;
2061         }
2062
2063
2064         if (  ( $mem->getID() == $member->getID() )
2065            && ( $mem->getDisplayName() != $member->getDisplayName() )
2066            ) {
2067             $mem->newCookieKey();
2068             $member->logout();
2069             $this->action_login(_MSG_LOGINAGAIN, 0);
2070         } else {
2071             $this->action_overview(_MSG_SETTINGSCHANGED);
2072         }
2073     }
2074
2075     /**
2076      * @todo document this
2077      */
2078     function action_memberadd() {
2079         global $member, $manager;
2080
2081         // check if allowed
2082         $member->isAdmin() or $this->disallow();
2083
2084         if (postVar('password') != postVar('repeatpassword'))
2085             $this->error(_ERROR_PASSWORDMISMATCH);
2086         if (i18n::strlen(postVar('password')) < 6)
2087             $this->error(_ERROR_PASSWORDTOOSHORT);
2088
2089         $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2090         if ($res != 1)
2091             $this->error($res);
2092
2093         // fire PostRegister event
2094         $newmem = new MEMBER();
2095         $newmem->readFromName(postVar('name'));
2096         $manager->notify('PostRegister',array('member' => &$newmem));
2097
2098         $this->action_usermanagement();
2099     }
2100
2101     /**
2102      * Account activation
2103      *
2104      * @author dekarma
2105      */
2106     function action_activate() {
2107
2108         $key = getVar('key');
2109         $this->_showActivationPage($key);
2110     }
2111
2112     /**
2113      * @todo document this
2114      */
2115     function _showActivationPage($key, $message = '')
2116     {
2117         global $manager;
2118
2119         // clean up old activation keys
2120         MEMBER::cleanupActivationTable();
2121
2122         // get activation info
2123         $info = MEMBER::getActivationInfo($key);
2124
2125         if (!$info)
2126             $this->error(_ERROR_ACTIVATE);
2127
2128         $mem = MEMBER::createFromId($info->vmember);
2129
2130         if (!$mem)
2131             $this->error(_ERROR_ACTIVATE);
2132
2133         $text = '';
2134         $title = '';
2135         $bNeedsPasswordChange = true;
2136
2137         switch ($info->vtype)
2138         {
2139             case 'forgot':
2140                 $title = _ACTIVATE_FORGOT_TITLE;
2141                 $text = _ACTIVATE_FORGOT_TEXT;
2142                 break;
2143             case 'register':
2144                 $title = _ACTIVATE_REGISTER_TITLE;
2145                 $text = _ACTIVATE_REGISTER_TEXT;
2146                 break;
2147             case 'addresschange':
2148                 $title = _ACTIVATE_CHANGE_TITLE;
2149                 $text = _ACTIVATE_CHANGE_TEXT;
2150                 $bNeedsPasswordChange = false;
2151                 MEMBER::activate($key);
2152                 break;
2153         }
2154
2155         $aVars = array(
2156             'memberName' => ENTITY::hsc($mem->getDisplayName())
2157         );
2158         $title = TEMPLATE::fill($title, $aVars);
2159         $text = TEMPLATE::fill($text, $aVars);
2160
2161         $this->pagehead();
2162
2163             echo '<h2>' , $title, '</h2>';
2164             echo '<p>' , $text, '</p>';
2165
2166             if ($message != '')
2167             {
2168                 echo '<p class="error">',$message,'</p>';
2169             }
2170
2171             if ($bNeedsPasswordChange)
2172             {
2173                 ?>
2174                     <div><form action="index.php" method="post">
2175
2176                         <input type="hidden" name="action" value="activatesetpwd" />
2177                         <?php $manager->addTicketHidden() ?>
2178                         <input type="hidden" name="key" value="<?php echo ENTITY::hsc($key) ?>" />
2179
2180                         <table><tr>
2181                             <td><?php echo _MEMBERS_PWD?></td>
2182                             <td><input type="password" maxlength="40" size="16" name="password" /></td>
2183                         </tr><tr>
2184                             <td><?php echo _MEMBERS_REPPWD?></td>
2185                             <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2186                         <?php
2187
2188                             global $manager;
2189                             $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2190
2191                         ?>
2192                         </tr><tr>
2193                             <td><?php echo _MEMBERS_SETPWD ?></td>
2194                             <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2195                         </tr></table>
2196
2197
2198                     </form></div>
2199
2200                 <?php
2201
2202             }
2203
2204         $this->pagefoot();
2205
2206     }
2207
2208     /**
2209      * Account activation - set password part
2210      *
2211      * @author dekarma
2212      */
2213     function action_activatesetpwd() {
2214
2215         $key = postVar('key');
2216
2217         // clean up old activation keys
2218         MEMBER::cleanupActivationTable();
2219
2220         // get activation info
2221         $info = MEMBER::getActivationInfo($key);
2222
2223         if (!$info || ($info->type == 'addresschange'))
2224             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2225
2226         $mem = MEMBER::createFromId($info->vmember);
2227
2228         if (!$mem)
2229             return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2230
2231         $password       = postVar('password');
2232         $repeatpassword = postVar('repeatpassword');
2233
2234         if ($password != $repeatpassword)
2235             return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2236
2237         if ($password && (i18n::strlen($password) < 6))
2238             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2239
2240         if ($password) {
2241                         $pwdvalid = true;
2242                         $pwderror = '';
2243                         global $manager;
2244                         $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
2245                         if (!$pwdvalid) {
2246                                 return $this->_showActivationPage($key,$pwderror);
2247                         }
2248                 }
2249
2250         $error = '';
2251
2252         $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2253         if ($error != '')
2254             return $this->_showActivationPage($key, $error);
2255
2256
2257         // set password
2258         $mem->setPassword($password);
2259         $mem->write();
2260
2261         // do the activation
2262         MEMBER::activate($key);
2263
2264         $this->pagehead();
2265             echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2266             echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2267         $this->pagefoot();
2268     }
2269
2270     /**
2271      * Manage team
2272      */
2273     function action_manageteam() {
2274         global $member, $manager;
2275
2276         $blogid = intRequestVar('blogid');
2277
2278         // check if allowed
2279         $member->blogAdminRights($blogid) or $this->disallow();
2280
2281         $this->pagehead();
2282
2283         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2284
2285         echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2286
2287         echo '<h3>' . _TEAM_CURRENT . '</h3>';
2288
2289
2290
2291         $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2292                . ' FROM '.sql_table('member').', '.sql_table('team')
2293                . ' WHERE tmember=mnumber and tblog=' . $blogid;
2294
2295         $template['content'] = 'teamlist';
2296         $template['tabindex'] = 10;
2297
2298         $manager->loadClass("ENCAPSULATE");
2299         $batch = new BATCH('team');
2300         $batch->showlist($query, 'table', $template);
2301
2302         ?>
2303             <h3><?php echo _TEAM_ADDNEW?></h3>
2304
2305             <form method='post' action='index.php'><div>
2306
2307             <input type='hidden' name='action' value='teamaddmember' />
2308             <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2309             <?php $manager->addTicketHidden() ?>
2310
2311             <table><tr>
2312                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2313                 <td><?php                   // TODO: try to make it so only non-team-members are listed
2314                     $query =  'SELECT mname as text, mnumber as value'
2315                            . ' FROM '.sql_table('member');
2316
2317                     $template['name'] = 'memberid';
2318                     $template['tabindex'] = 10000;
2319                     showlist($query,'select',$template);
2320                 ?></td>
2321             </tr><tr>
2322                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2323                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2324             </tr><tr>
2325                 <td><?php echo _TEAM_ADD?></td>
2326                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2327             </tr></table>
2328
2329             </div></form>
2330         <?php
2331         $this->pagefoot();
2332     }
2333
2334     /**
2335      * Add member to team
2336      */
2337     function action_teamaddmember() {
2338         global $member, $manager;
2339
2340         $memberid = intPostVar('memberid');
2341         $blogid = intPostVar('blogid');
2342         $admin = intPostVar('admin');
2343
2344         // check if allowed
2345         $member->blogAdminRights($blogid) or $this->disallow();
2346
2347         $blog =& $manager->getBlog($blogid);
2348         if (!$blog->addTeamMember($memberid, $admin))
2349             $this->error(_ERROR_ALREADYONTEAM);
2350
2351         $this->action_manageteam();
2352
2353     }
2354
2355     /**
2356      * @todo document this
2357      */
2358     function action_teamdelete() {
2359         global $member, $manager;
2360
2361         $memberid = intRequestVar('memberid');
2362         $blogid = intRequestVar('blogid');
2363
2364         // check if allowed
2365         $member->blogAdminRights($blogid) or $this->disallow();
2366
2367         $teammem = MEMBER::createFromID($memberid);
2368         $blog =& $manager->getBlog($blogid);
2369
2370         $this->pagehead();
2371         ?>
2372             <h2><?php echo _DELETE_CONFIRM?></h2>
2373
2374             <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  ENTITY::hsc($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  ENTITY::hsc(strip_tags($blog->getName())) ?></b>
2375             </p>
2376
2377
2378             <form method="post" action="index.php"><div>
2379             <input type="hidden" name="action" value="teamdeleteconfirm" />
2380             <?php $manager->addTicketHidden() ?>
2381             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2382             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2383             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2384             </div></form>
2385         <?php
2386         $this->pagefoot();
2387     }
2388
2389     /**
2390      * @todo document this
2391      */
2392     function action_teamdeleteconfirm() {
2393         global $member;
2394
2395         $memberid = intRequestVar('memberid');
2396         $blogid = intRequestVar('blogid');
2397
2398         $error = $this->deleteOneTeamMember($blogid, $memberid);
2399         if ($error)
2400             $this->error($error);
2401
2402
2403         $this->action_manageteam();
2404     }
2405
2406     /**
2407      * @todo document this
2408      */
2409     function deleteOneTeamMember($blogid, $memberid) {
2410         global $member, $manager;
2411
2412         $blogid = intval($blogid);
2413         $memberid = intval($memberid);
2414
2415         // check if allowed
2416         if (!$member->blogAdminRights($blogid))
2417             return _ERROR_DISALLOWED;
2418
2419         // check if: - there remains at least one blog admin
2420         //           - (there remains at least one team member)
2421         $tmem = MEMBER::createFromID($memberid);
2422
2423         $manager->notify('PreDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2424
2425         if ($tmem->isBlogAdmin($blogid)) {
2426             // check if there are more blog members left and at least one admin
2427             // (check for at least two admins before deletion)
2428             $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2429             $r = sql_query($query);
2430             if (sql_num_rows($r) < 2)
2431                 return _ERROR_ATLEASTONEBLOGADMIN;
2432         }
2433
2434         $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2435         sql_query($query);
2436
2437         $manager->notify('PostDeleteTeamMember', array('member' => &$tmem, 'blogid' => $blogid));
2438
2439         return '';
2440     }
2441
2442     /**
2443      * @todo document this
2444      */
2445     function action_teamchangeadmin() {
2446         global $member;
2447
2448         $blogid = intRequestVar('blogid');
2449         $memberid = intRequestVar('memberid');
2450
2451         // check if allowed
2452         $member->blogAdminRights($blogid) or $this->disallow();
2453
2454         $mem = MEMBER::createFromID($memberid);
2455
2456         // don't allow when there is only one admin at this moment
2457         if ($mem->isBlogAdmin($blogid)) {
2458             $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2459             if (sql_num_rows($r) == 1)
2460                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2461         }
2462
2463         if ($mem->isBlogAdmin($blogid))
2464             $newval = 0;
2465         else
2466             $newval = 1;
2467
2468         $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2469         sql_query($query);
2470
2471         // only show manageteam if member did not change its own admin privileges
2472         if ($member->isBlogAdmin($blogid))
2473             $this->action_manageteam();
2474         else
2475             $this->action_overview(_MSG_ADMINCHANGED);
2476     }
2477
2478     /**
2479      * @todo document this
2480      */
2481     function action_blogsettings() {
2482         global $member, $manager;
2483
2484         $blogid = intRequestVar('blogid');
2485
2486         // check if allowed
2487         $member->blogAdminRights($blogid) or $this->disallow();
2488
2489         $blog =& $manager->getBlog($blogid);
2490
2491         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2492         $this->pagehead($extrahead);
2493
2494         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2495         ?>
2496         <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2497
2498         <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2499
2500         <p><?php echo _EBLOG_CURRENT_TEAM_MEMBER; ?>
2501         <?php
2502             $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2503             $aMemberNames = array();
2504             while ($o = sql_fetch_object($res))
2505                 array_push($aMemberNames, ENTITY::hsc($o->mname) . ' (' . ENTITY::hsc($o->mrealname). ')');
2506             echo implode(',', $aMemberNames);
2507         ?>
2508         </p>
2509
2510
2511
2512         <p>
2513         <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2514         </p>
2515
2516         <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2517
2518         <form method="post" action="index.php"><div>
2519
2520         <input type="hidden" name="action" value="blogsettingsupdate" />
2521         <?php $manager->addTicketHidden() ?>
2522         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2523         <table><tr>
2524             <td><?php echo _EBLOG_NAME?></td>
2525             <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getName()) ?>" /></td>
2526         </tr><tr>
2527             <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2528                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2529             </td>
2530             <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  ENTITY::hsc($blog->getShortName()) ?>" /></td>
2531         </tr><tr>
2532             <td><?php echo _EBLOG_DESC?></td>
2533             <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  ENTITY::hsc($blog->getDescription()) ?>" /></td>
2534         </tr><tr>
2535             <td><?php echo _EBLOG_URL?></td>
2536             <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  ENTITY::hsc($blog->getURL()) ?>" /></td>
2537         </tr><tr>
2538             <td><?php echo _EBLOG_DEFSKIN?>
2539                 <?php help('blogdefaultskin'); ?>
2540             </td>
2541             <td>
2542                 <?php
2543                     $query =  'SELECT sdname as text, sdnumber as value'
2544                            . ' FROM '.sql_table('skin_desc');
2545                     $template['name'] = 'defskin';
2546                     $template['selected'] = $blog->getDefaultSkin();
2547                     $template['tabindex'] = 50;
2548                     showlist($query,'select',$template);
2549                 ?>
2550
2551             </td>
2552         </tr><tr>
2553             <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2554             </td>
2555             <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2556         </tr><tr>
2557             <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2558             </td>
2559             <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2560         </tr><tr>
2561             <td><?php echo _EBLOG_DISABLECOMMENTS?>
2562             </td>
2563             <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2564         </tr><tr>
2565             <td><?php echo _EBLOG_ANONYMOUS?>
2566             </td>
2567             <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2568         </tr><tr>
2569     <td><?php echo _EBLOG_REQUIREDEMAIL?>
2570          </td>
2571          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2572       </tr><tr>
2573             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2574             <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  ENTITY::hsc($blog->getNotifyAddress()); ?>" /></td>
2575         </tr><tr>
2576             <td><?php echo _EBLOG_NOTIFY_ON?></td>
2577             <td>
2578                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2579                     <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2580                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2581                 <br />
2582                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2583                     <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2584                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2585                 <br />
2586                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2587                     <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2588                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2589             </td>
2590         </tr><tr>
2591             <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2592             <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  ENTITY::hsc($blog->getMaxComments()); ?>" /></td>
2593         </tr><tr>
2594             <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2595             <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  ENTITY::hsc($blog->getUpdateFile()) ?>" /></td>
2596         </tr><tr>
2597             <td><?php echo _EBLOG_DEFCAT?></td>
2598             <td>
2599                 <?php
2600                     $query =  'SELECT cname as text, catid as value'
2601                            . ' FROM '.sql_table('category')
2602                            . ' WHERE cblog=' . $blog->getID();
2603                     $template['name'] = 'defcat';
2604                     $template['selected'] = $blog->getDefaultCategory();
2605                     $template['tabindex'] = 110;
2606                     showlist($query,'select',$template);
2607                 ?>
2608             </td>
2609         </tr><tr>
2610             <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2611                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  i18n::strftime("%H:%M",time()); ?></b>
2612                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  i18n::strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2613                 </td>
2614             <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  ENTITY::hsc($blog->getTimeOffset()); ?>" /></td>
2615         </tr><tr>
2616             <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2617             <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2618         </tr>
2619         <?php
2620             // plugin options
2621             $this->_insertPluginOptions('blog',$blogid);
2622         ?>
2623         <tr>
2624             <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2625         </tr><tr>
2626             <td><?php echo _EBLOG_CHANGE?></td>
2627             <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2628         </tr></table>
2629
2630         </div></form>
2631
2632         <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2633
2634
2635         <?php
2636         $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2637         $template['content'] = 'categorylist';
2638         $template['tabindex'] = 200;
2639
2640         $manager->loadClass("ENCAPSULATE");
2641         $batch = new BATCH('category');
2642         $batch->showlist($query,'table',$template);
2643
2644         ?>
2645
2646
2647         <form action="index.php" method="post"><div>
2648         <input name="action" value="categorynew" type="hidden" />
2649         <?php $manager->addTicketHidden() ?>
2650         <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2651
2652         <table><tr>
2653             <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2654         </tr><tr>
2655             <td><?php echo _EBLOG_CAT_NAME?></td>
2656             <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2657         </tr><tr>
2658             <td><?php echo _EBLOG_CAT_DESC?></td>
2659             <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2660         </tr><tr>
2661             <td><?php echo _EBLOG_CAT_CREATE?></td>
2662             <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2663         </tr></table>
2664
2665         </div></form>
2666
2667         <?php
2668
2669             echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2670
2671             $manager->notify(
2672                 'BlogSettingsFormExtras',
2673                 array(
2674                     'blog' => &$blog
2675                 )
2676             );
2677
2678         $this->pagefoot();
2679     }
2680
2681     /**
2682      * @todo document this
2683      */
2684     function action_categorynew() {
2685         global $member, $manager;
2686
2687         $blogid = intRequestVar('blogid');
2688
2689         $member->blogAdminRights($blogid) or $this->disallow();
2690
2691         $cname = postVar('cname');
2692         $cdesc = postVar('cdesc');
2693
2694         if (!isValidCategoryName($cname))
2695             $this->error(_ERROR_BADCATEGORYNAME);
2696
2697         $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
2698         $res = sql_query($query);
2699         if (sql_num_rows($res) > 0)
2700             $this->error(_ERROR_DUPCATEGORYNAME);
2701
2702         $blog       =& $manager->getBlog($blogid);
2703         $newCatID   =  $blog->createNewCategory($cname, $cdesc);
2704
2705         $this->action_blogsettings();
2706     }
2707
2708     /**
2709      * @todo document this
2710      */
2711     function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2712         global $member, $manager;
2713
2714         if ($blogid == '')
2715             $blogid = intGetVar('blogid');
2716         else
2717             $blogid = intval($blogid);
2718         if ($catid == '')
2719             $catid = intGetVar('catid');
2720         else
2721             $catid = intval($catid);
2722
2723         $member->blogAdminRights($blogid) or $this->disallow();
2724
2725         $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2726         $obj = sql_fetch_object($res);
2727
2728         $cname = $obj->cname;
2729         $cdesc = $obj->cdesc;
2730
2731         $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2732         $this->pagehead($extrahead);
2733
2734         echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2735
2736         ?>
2737         <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo ENTITY::hsc($cname)?>'</h2>
2738         <form method='post' action='index.php'><div>
2739         <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2740         <input name="catid" type="hidden" value="<?php echo $catid?>" />
2741         <input name="desturl" type="hidden" value="<?php echo ENTITY::hsc($desturl) ?>" />
2742         <input name="action" type="hidden" value="categoryupdate" />
2743         <?php $manager->addTicketHidden(); ?>
2744
2745         <table><tr>
2746             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2747         </tr><tr>
2748             <td><?php echo _EBLOG_CAT_NAME?></td>
2749             <td><input type="text" name="cname" value="<?php echo ENTITY::hsc($cname)?>" size="40" maxlength="40" /></td>
2750         </tr><tr>
2751             <td><?php echo _EBLOG_CAT_DESC?></td>
2752             <td><input type="text" name="cdesc" value="<?php echo ENTITY::hsc($cdesc)?>" size="40" maxlength="200" /></td>
2753         </tr>
2754         <?php
2755             // insert plugin options
2756             $this->_insertPluginOptions('category',$catid);
2757         ?>
2758         <tr>
2759             <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2760         </tr><tr>
2761             <td><?php echo _EBLOG_CAT_UPDATE?></td>
2762             <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2763         </tr></table>
2764
2765         </div></form>
2766         <?php
2767         $this->pagefoot();
2768     }
2769
2770     /**
2771      * @todo document this
2772      */
2773     function action_categoryupdate() {
2774         global $member, $manager;
2775
2776         $blogid = intPostVar('blogid');
2777         $catid = intPostVar('catid');
2778         $cname = postVar('cname');
2779         $cdesc = postVar('cdesc');
2780         $desturl = postVar('desturl');
2781
2782         $member->blogAdminRights($blogid) or $this->disallow();
2783
2784         if (!isValidCategoryName($cname))
2785             $this->error(_ERROR_BADCATEGORYNAME);
2786
2787         $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2788         $res = sql_query($query);
2789         if (sql_num_rows($res) > 0)
2790             $this->error(_ERROR_DUPCATEGORYNAME);
2791
2792         $query =  'UPDATE '.sql_table('category').' SET'
2793                . " cname='" . sql_real_escape_string($cname) . "',"
2794                . " cdesc='" . sql_real_escape_string($cdesc) . "'"
2795                . " WHERE catid=" . $catid;
2796
2797         sql_query($query);
2798
2799         // store plugin options
2800         $aOptions = requestArray('plugoption');
2801         NucleusPlugin::apply_plugin_options($aOptions);
2802         $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2803
2804
2805         if ($desturl) {
2806             redirect($desturl);
2807             exit;
2808         } else {
2809             $this->action_blogsettings();
2810         }
2811     }
2812
2813     /**
2814      * @todo document this
2815      */
2816     function action_categorydelete() {
2817         global $member, $manager;
2818
2819         $blogid = intRequestVar('blogid');
2820         $catid = intRequestVar('catid');
2821
2822         $member->blogAdminRights($blogid) or $this->disallow();
2823
2824         $blog =& $manager->getBlog($blogid);
2825
2826         // check if the category is valid
2827         if (!$blog->isValidCategory($catid))
2828             $this->error(_ERROR_NOSUCHCATEGORY);
2829
2830         // don't allow deletion of default category
2831         if ($blog->getDefaultCategory() == $catid)
2832             $this->error(_ERROR_DELETEDEFCATEGORY);
2833
2834         // check if catid is the only category left for blogid
2835         $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2836         $res = sql_query($query);
2837         if (sql_num_rows($res) == 1)
2838             $this->error(_ERROR_DELETELASTCATEGORY);
2839
2840
2841         $this->pagehead();
2842         ?>
2843             <h2><?php echo _DELETE_CONFIRM?></h2>
2844
2845             <div>
2846             <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  ENTITY::hsc($blog->getCategoryName($catid))?></b>
2847             </div>
2848
2849             <form method="post" action="index.php"><div>
2850             <input type="hidden" name="action" value="categorydeleteconfirm" />
2851             <?php $manager->addTicketHidden() ?>
2852             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2853             <input type="hidden" name="catid" value="<?php echo $catid?>" />
2854             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2855             </div></form>
2856         <?php
2857         $this->pagefoot();
2858     }
2859
2860     /**
2861      * @todo document this
2862      */
2863     function action_categorydeleteconfirm() {
2864         global $member, $manager;
2865
2866         $blogid = intRequestVar('blogid');
2867         $catid = intRequestVar('catid');
2868
2869         $member->blogAdminRights($blogid) or $this->disallow();
2870
2871         $error = $this->deleteOneCategory($catid);
2872         if ($error)
2873             $this->error($error);
2874
2875         $this->action_blogsettings();
2876     }
2877
2878         /**
2879          * ADMIN::deleteOneCategory()
2880          * Delete a category by its id
2881          *
2882          * @param       String  $catid  category id for deleting
2883          * @return      Void
2884          */
2885         function deleteOneCategory($catid)
2886         {
2887                 global $manager, $member;
2888
2889                 $catid = intval($catid);
2890                 $blogid = getBlogIDFromCatID($catid);
2891
2892                 if ( !$member->blogAdminRights($blogid) )
2893                 {
2894                         return ERROR_DISALLOWED;
2895                 }
2896
2897                 // get blog
2898                 $blog =& $manager->getBlog($blogid);
2899
2900                 // check if the category is valid
2901                 if ( !$blog || !$blog->isValidCategory($catid) )
2902                 {
2903                         return _ERROR_NOSUCHCATEGORY;
2904                 }
2905
2906                 $destcatid = $blog->getDefaultCategory();
2907
2908                 // don't allow deletion of default category
2909                 if ( $blog->getDefaultCategory() == $catid )
2910                 {
2911                         return _ERROR_DELETEDEFCATEGORY;
2912                 }
2913
2914                 // check if catid is the only category left for blogid
2915                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2916                 $res = sql_query($query);
2917                 if ( sql_num_rows($res) == 1 )
2918                 {
2919                         return _ERROR_DELETELASTCATEGORY;
2920                 }
2921
2922                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2923
2924                 // change category for all items to the default category
2925                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2926                 sql_query($query);
2927
2928                 // delete all associated plugin options
2929                 NucleusPlugin::delete_option_values('category', $catid);
2930
2931                 // delete category
2932                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2933                 sql_query($query);
2934
2935                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2936                 return;
2937         }
2938
2939         /**
2940          * ADMIN::action_blogsettingsupdate
2941          * Updating blog settings
2942          *
2943          * @param       Void
2944          * @return      Void
2945          */
2946         function action_blogsettingsupdate()
2947         {
2948                 global $member, $manager;
2949
2950                 $blogid = intRequestVar('blogid');
2951
2952                 $member->blogAdminRights($blogid) or $this->disallow();
2953
2954                 $blog =& $manager->getBlog($blogid);
2955
2956                 $notify_address = trim(postVar('notify'));
2957                 $shortname              = trim(postVar('shortname'));
2958                 $updatefile     = trim(postVar('update'));
2959
2960                 $notifyComment  = intPostVar('notifyComment');
2961                 $notifyVote             = intPostVar('notifyVote');
2962                 $notifyNewItem  = intPostVar('notifyNewItem');
2963
2964                 if ( $notifyComment == 0 )
2965                 {
2966                         $notifyComment = 1;
2967                 }
2968                 if ( $notifyVote == 0 )
2969                 {
2970                         $notifyVote = 1;
2971                 }
2972                 if ( $notifyNewItem == 0 )
2973                 {
2974                         $notifyNewItem = 1;
2975                 }
2976                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2977
2978                 if ( $notify_address && !NOTIFICATION::address_validation($notify_address) )
2979                 {
2980                         $this->error(_ERROR_BADNOTIFY);
2981                 }
2982
2983                 if ( !isValidShortName($shortname) )
2984                 {
2985                         $this->error(_ERROR_BADSHORTBLOGNAME);
2986                 }
2987
2988                 if ( ($blog->getShortName() != $shortname) && $manager->existsBlog($shortname) )
2989                 {
2990                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2991                 }
2992                 // check if update file is writable
2993                 if ( $updatefile && !is_writeable($updatefile) )
2994                 {
2995                         $this->error(_ERROR_UPDATEFILE);
2996                 }
2997
2998                 $blog->setName(trim(postVar('name')));
2999                 $blog->setShortName($shortname);
3000                 $blog->setNotifyAddress($notify_address);
3001                 $blog->setNotifyType($notifyType);
3002                 $blog->setMaxComments(postVar('maxcomments'));
3003                 $blog->setCommentsEnabled(postVar('comments'));
3004                 $blog->setTimeOffset(postVar('timeoffset'));
3005                 $blog->setUpdateFile($updatefile);
3006                 $blog->setURL(trim(postVar('url')));
3007                 $blog->setDefaultSkin(intPostVar('defskin'));
3008                 $blog->setDescription(trim(postVar('desc')));
3009                 $blog->setPublic(postVar('public'));
3010                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
3011                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
3012                 $blog->setDefaultCategory(intPostVar('defcat'));
3013                 $blog->setSearchable(intPostVar('searchable'));
3014                 $blog->setEmailRequired(intPostVar('reqemail'));
3015                 $blog->writeSettings();
3016
3017                 // store plugin options
3018                 $aOptions = requestArray('plugoption');
3019                 NucleusPlugin::apply_plugin_options($aOptions);
3020                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3021
3022                 $this->action_overview(_MSG_SETTINGSCHANGED);
3023                 return;
3024         }
3025
3026     /**
3027      * @todo document this
3028      */
3029     function action_deleteblog() {
3030         global $member, $CONF, $manager;
3031
3032         $blogid = intRequestVar('blogid');
3033
3034         $member->blogAdminRights($blogid) or $this->disallow();
3035
3036         // check if blog is default blog
3037         if ($CONF['DefaultBlog'] == $blogid)
3038             $this->error(_ERROR_DELDEFBLOG);
3039
3040         $blog =& $manager->getBlog($blogid);
3041
3042         $this->pagehead();
3043         ?>
3044             <h2><?php echo _DELETE_CONFIRM?></h2>
3045
3046             <p><?php echo _WARNINGTXT_BLOGDEL?>
3047             </p>
3048
3049             <div>
3050             <?php echo _CONFIRMTXT_BLOG?><b><?php echo  ENTITY::hsc($blog->getName())?></b>
3051             </div>
3052
3053             <form method="post" action="index.php"><div>
3054             <input type="hidden" name="action" value="deleteblogconfirm" />
3055             <?php $manager->addTicketHidden() ?>
3056             <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3057             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3058             </div></form>
3059         <?php
3060         $this->pagefoot();
3061     }
3062
3063         /**
3064          * ADMIN::action_deleteblogconfirm()
3065          * Delete Blog
3066          *
3067          * @param       Void
3068          * @return      Void
3069          */
3070         function action_deleteblogconfirm()
3071         {
3072                 global $member, $CONF, $manager;
3073
3074                 $blogid = intRequestVar('blogid');
3075                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3076                 $member->blogAdminRights($blogid) or $this->disallow();
3077
3078                 // check if blog is default blog
3079                 if ( $CONF['DefaultBlog'] == $blogid )
3080                 {
3081                         $this->error(_ERROR_DELDEFBLOG);
3082                 }
3083
3084                 // delete all comments
3085                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3086                 sql_query($query);
3087
3088                 // delete all items
3089                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3090                 sql_query($query);
3091
3092                 // delete all team members
3093                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3094                 sql_query($query);
3095
3096                 // delete all bans
3097                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3098                 sql_query($query);
3099
3100                 // delete all categories
3101                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3102                 sql_query($query);
3103
3104                 // delete all associated plugin options
3105                 NucleusPlugin::delete_option_values('blog', $blogid);
3106
3107                 // delete the blog itself
3108                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3109                 sql_query($query);
3110
3111                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3112
3113                 $this->action_overview(_DELETED_BLOG);
3114                 return;
3115         }
3116
3117     /**
3118      * @todo document this
3119      */
3120     function action_memberdelete() {
3121         global $member, $manager;
3122
3123         $memberid = intRequestVar('memberid');
3124
3125         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3126
3127         $mem = MEMBER::createFromID($memberid);
3128
3129         $this->pagehead();
3130         ?>
3131             <h2><?php echo _DELETE_CONFIRM?></h2>
3132
3133             <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo ENTITY::hsc($mem->getDisplayName()) ?></b>
3134             </p>
3135
3136             <p>
3137             <?php echo _WARNINGTXT_NOTDELMEDIAFILES ?>
3138             </p>
3139
3140             <form method="post" action="index.php"><div>
3141             <input type="hidden" name="action" value="memberdeleteconfirm" />
3142             <?php $manager->addTicketHidden() ?>
3143             <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3144             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3145             </div></form>
3146         <?php
3147         $this->pagefoot();
3148     }
3149
3150     /**
3151      * @todo document this
3152      */
3153     function action_memberdeleteconfirm() {
3154         global $member;
3155
3156         $memberid = intRequestVar('memberid');
3157
3158         ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3159
3160         $error = $this->deleteOneMember($memberid);
3161         if ($error)
3162             $this->error($error);
3163
3164         if ($member->isAdmin())
3165             $this->action_usermanagement();
3166         else
3167             $this->action_overview(_DELETED_MEMBER);
3168     }
3169
3170         /**
3171          * ADMIN::deleteOneMember()
3172          * Delete a member by id
3173          *
3174          * @static
3175          * @params      Integer $memberid       member id
3176          * @return      String  null string or error messages
3177          */
3178         function deleteOneMember($memberid)
3179         {
3180                 global $manager;
3181
3182                 $memberid = intval($memberid);
3183                 $mem = MEMBER::createFromID($memberid);
3184
3185                 if ( !$mem->canBeDeleted() )
3186                 {
3187                         return _ERROR_DELETEMEMBER;
3188                 }
3189
3190                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3191
3192                 /* unlink comments from memberid */
3193                 if ( $memberid )
3194                 {
3195                         $query = "UPDATE %s SET cmember=0, cuser='%s' WHERE cmember=%d";
3196                         $query = sprintf($query, sql_table('comment'), sql_real_escape_string($mem->getDisplayName()), $memberid);
3197                         sql_query($query);
3198                 }
3199
3200                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3201                 sql_query($query);
3202
3203                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3204                 sql_query($query);
3205
3206                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3207                 sql_query($query);
3208
3209                 // delete all associated plugin options
3210                 NucleusPlugin::delete_option_values('member', $memberid);
3211
3212                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3213
3214                 return '';
3215         }
3216
3217     /**
3218      * @todo document this
3219      */
3220     function action_createnewlog() {
3221         global $member, $CONF, $manager;
3222
3223         // Only Super-Admins can do this
3224         $member->isAdmin() or $this->disallow();
3225
3226         $this->pagehead();
3227
3228         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3229         ?>
3230         <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3231
3232         <h3><?php echo _ADMIN_NOTABILIA ?></h3>
3233
3234         <p><?php echo _ADMIN_PLEASE_READ ?></p>
3235
3236         <p><?php echo _ADMIN_HOW_TO_ACCESS ?></p>
3237
3238         <ol>
3239             <li><?php echo _ADMIN_SIMPLE_WAY ?></li>
3240             <li><?php echo _ADMIN_ADVANCED_WAY ?></li>
3241         </ol>
3242
3243         <h3><?php echo _ADMIN_HOW_TO_CREATE ?></h3>
3244
3245         <p>
3246         <?php echo _EBLOG_CREATE_TEXT?>
3247         </p>
3248
3249         <form method="post" action="index.php"><div>
3250
3251         <input type="hidden" name="action" value="addnewlog" />
3252         <?php $manager->addTicketHidden() ?>
3253
3254
3255         <table><tr>
3256             <td><?php echo _EBLOG_NAME?></td>
3257             <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3258         </tr><tr>
3259             <td><?php echo _EBLOG_SHORTNAME?>
3260                 <?php help('shortblogname'); ?>
3261             </td>
3262             <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3263         </tr><tr>
3264             <td><?php echo _EBLOG_DESC?></td>
3265             <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3266         </tr><tr>
3267             <td><?php echo _EBLOG_DEFSKIN?>
3268                 <?php help('blogdefaultskin'); ?>
3269             </td>
3270             <td>
3271                 <?php
3272                     $query =  'SELECT sdname as text, sdnumber as value'
3273                            . ' FROM '.sql_table('skin_desc');
3274                     $template['name'] = 'defskin';
3275                     $template['tabindex'] = 50;
3276                     $template['selected'] = $CONF['BaseSkin'];  // set default selected skin to be globally defined base skin
3277                     showlist($query,'select',$template);
3278                 ?>
3279             </td>
3280         </tr><tr>
3281             <td><?php echo _EBLOG_OFFSET?>
3282                 <?php help('blogtimeoffset'); ?>
3283                 <br /><?php echo _EBLOG_STIME?> <b><?php echo i18n::strftime("%H:%M",time()); ?></b>
3284             </td>
3285             <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3286         </tr><tr>
3287             <td><?php echo _EBLOG_ADMIN?>
3288                 <?php help('teamadmin'); ?>
3289             </td>
3290             <td><?php echo _EBLOG_ADMIN_MSG?></td>
3291         </tr><tr>
3292             <td><?php echo _EBLOG_CREATE?></td>
3293             <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3294         </tr></table>
3295
3296         </div></form>
3297         <?php
3298         $this->pagefoot();
3299     }
3300
3301     /**
3302      * @todo document this
3303      */
3304     function action_addnewlog() {
3305         global $member, $manager, $CONF;
3306
3307         // Only Super-Admins can do this
3308         $member->isAdmin() or $this->disallow();
3309
3310         $bname          = trim(postVar('name'));
3311         $bshortname     = trim(postVar('shortname'));
3312         $btimeoffset    = postVar('timeoffset');
3313         $bdesc          = trim(postVar('desc'));
3314         $bdefskin       = postVar('defskin');
3315
3316         if (!isValidShortName($bshortname))
3317             $this->error(_ERROR_BADSHORTBLOGNAME);
3318
3319         if ($manager->existsBlog($bshortname))
3320             $this->error(_ERROR_DUPSHORTBLOGNAME);
3321
3322         $manager->notify(
3323             'PreAddBlog',
3324             array(
3325                 'name' => &$bname,
3326                 'shortname' => &$bshortname,
3327                 'timeoffset' => &$btimeoffset,
3328                 'description' => &$bdesc,
3329                 'defaultskin' => &$bdefskin
3330             )
3331         );
3332
3333
3334         // add slashes for sql queries
3335         $bname =        sql_real_escape_string($bname);
3336         $bshortname =   sql_real_escape_string($bshortname);
3337         $btimeoffset =  sql_real_escape_string($btimeoffset);
3338         $bdesc =        sql_real_escape_string($bdesc);
3339         $bdefskin =     sql_real_escape_string($bdefskin);
3340
3341         // create blog
3342         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3343         sql_query($query);
3344         $blogid = sql_insert_id();
3345         $blog   =& $manager->getBlog($blogid);
3346
3347         // create new category
3348         $catdefname = (defined('_EBLOGDEFAULTCATEGORY_NAME') ? _EBLOGDEFAULTCATEGORY_NAME : 'General');
3349         $catdefdesc = (defined('_EBLOGDEFAULTCATEGORY_DESC') ? _EBLOGDEFAULTCATEGORY_DESC : 'Items that do not fit in other categories');
3350         $sql = 'INSERT INTO %s (cblog, cname, cdesc) VALUES (%d, "%s", "%s")';
3351         sql_query(sprintf($sql, sql_table('category'), $blogid, $catdefname, $catdefdesc));
3352 //              sql_query(sprintf($sql, sql_table('category'), $blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC));
3353 //              sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, _EBLOGDEFAULTCATEGORY_NAME, _EBLOGDEFAULTCATEGORY_DESC)");
3354         $catid = sql_insert_id();
3355
3356         // set as default category
3357         $blog->setDefaultCategory($catid);
3358         $blog->writeSettings();
3359
3360         // create team member
3361         $memberid = $member->getID();
3362         $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3363         sql_query($query);
3364
3365         $itemdeftitle = (defined('_EBLOG_FIRSTITEM_TITLE') ? _EBLOG_FIRSTITEM_TITLE : 'First Item');
3366         $itemdefbody = (defined('_EBLOG_FIRSTITEM_BODY') ? _EBLOG_FIRSTITEM_BODY : 'This is the first item in your weblog. Feel free to delete it.');
3367
3368         $blog->additem($blog->getDefaultCategory(),$itemdeftitle,$itemdefbody,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3369         //$blog->additem($blog->getDefaultCategory(),_EBLOG_FIRSTITEM_TITLE,_EBLOG_FIRSTITEM_BODY,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3370
3371
3372
3373         $manager->notify(
3374             'PostAddBlog',
3375             array(
3376                 'blog' => &$blog
3377             )
3378         );
3379
3380         $manager->notify(
3381             'PostAddCategory',
3382             array(
3383                 'blog' => &$blog,
3384                 'name' => _EBLOGDEFAULTCATEGORY_NAME,
3385                 'description' => _EBLOGDEFAULTCATEGORY_DESC,
3386                 'catid' => $catid
3387             )
3388         );
3389
3390         $this->pagehead();
3391         ?>
3392         <h2><?php echo _BLOGCREATED_TITLE ?></h2>
3393
3394         <p><?php echo sprintf(_BLOGCREATED_ADDEDTXT, ENTITY::hsc($bname)) ?></p>
3395
3396         <ol>
3397             <li><a href="#index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEWAY, ENTITY::hsc($bshortname)) ?></a></li>
3398             <li><a href="#skins"><?php echo _BLOGCREATED_ADVANCEDWAY ?></a></li>
3399         </ol>
3400
3401         <h3><a id="index_php"><?php echo sprintf(_BLOGCREATED_SIMPLEDESC1, ENTITY::hsc($bshortname)) ?></a></h3>
3402
3403         <p><?php echo sprintf(_BLOGCREATED_SIMPLEDESC2, ENTITY::hsc($bshortname)) ?></p>
3404 <pre><code>&lt;?php
3405
3406 $CONF['Self'] = '<b><?php echo ENTITY::hsc($bshortname)?>.php</b>';
3407
3408 include('<i>./config.php</i>');
3409
3410 selectBlog('<b><?php echo ENTITY::hsc($bshortname)?></b>');
3411 selector();
3412
3413 ?&gt;</code></pre>
3414
3415         <p><?php echo _BLOGCREATED_SIMPLEDESC3 ?></p>
3416
3417         <p><?php echo _BLOGCREATED_SIMPLEDESC4 ?></p>
3418
3419         <form action="index.php" method="post"><div>
3420             <input type="hidden" name="action" value="addnewlog2" />
3421             <?php $manager->addTicketHidden() ?>
3422             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3423             <table><tr>
3424                 <td><?php echo _EBLOG_URL?></td>
3425                 <td><input name="url" maxlength="100" size="40" value="<?php echo ENTITY::hsc($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3426             </tr><tr>
3427                 <td><?php echo _EBLOG_CREATE?></td>
3428                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3429             </tr></table>
3430         </div></form>
3431
3432         <h3><a id="skins"><?php echo _BLOGCREATED_ADVANCEDWAY2 ?></a></h3>
3433
3434         <p><?php echo _BLOGCREATED_ADVANCEDWAY3 ?></p>
3435
3436         <form action="index.php" method="post"><div>
3437             <input type="hidden" name="action" value="addnewlog2" />
3438             <?php $manager->addTicketHidden() ?>
3439             <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3440             <table><tr>
3441                 <td><?php echo _EBLOG_URL?></td>
3442                 <td><input name="url" maxlength="100" size="40" /></td>
3443             </tr><tr>
3444                 <td><?php echo _EBLOG_CREATE?></td>
3445                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3446             </tr></table>
3447         </div></form>
3448
3449         <?php       $this->pagefoot();
3450
3451     }
3452
3453     /**
3454      * @todo document this
3455      */
3456     function action_addnewlog2() {
3457         global $member, $manager;
3458
3459         $member->blogAdminRights($blogid) or $this->disallow();
3460
3461         $burl   = requestVar('url');
3462         $blogid = intRequestVar('blogid');
3463
3464         $blog =& $manager->getBlog($blogid);
3465         $blog->setURL(trim($burl));
3466         $blog->writeSettings();
3467
3468         $this->action_overview(_MSG_NEWBLOG);
3469     }
3470
3471     /**
3472      * @todo document this
3473      */
3474     function action_skinieoverview() {
3475         global $member, $DIR_LIBS, $manager;
3476
3477         $member->isAdmin() or $this->disallow();
3478
3479         // load skinie class
3480         include_once($DIR_LIBS . 'skinie.php');
3481
3482         $this->pagehead();
3483
3484         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3485
3486     ?>
3487         <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3488
3489                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3490                 <?php                   global $DIR_SKINS;
3491
3492                     $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3493
3494                     if (sizeof($candidates) > 0) {
3495                         ?>
3496                             <form method="post" action="index.php"><div>
3497                                 <input type="hidden" name="action" value="skinieimport" />
3498                                 <?php $manager->addTicketHidden() ?>
3499                                 <input type="hidden" name="mode" value="file" />
3500                                 <select name="skinfile" id="skinie_import_local">
3501                                 <?php                                   foreach ($candidates as $skinname => $skinfile) {
3502                                         $html = ENTITY::hsc($skinfile);
3503                                         echo '<option value="',$html,'">',$skinname,'</option>';
3504                                     }
3505                                 ?>
3506                                 </select>
3507                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3508                             </div></form>
3509                         <?php                   } else {
3510                         echo _SKINIE_NOCANDIDATES;
3511                     }
3512                 ?>
3513                 </p>
3514
3515                 <p><em><?php echo _OR?></em></p>
3516
3517                 <form method="post" action="index.php"><p>
3518                     <?php $manager->addTicketHidden() ?>
3519                     <input type="hidden" name="action" value="skinieimport" />
3520                     <input type="hidden" name="mode" value="url" />
3521                     <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3522                     <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3523                     <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3524                 </p></form>
3525
3526
3527         <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3528         <form method="post" action="index.php"><div>
3529             <input type="hidden" name="action" value="skinieexport" />
3530             <?php $manager->addTicketHidden() ?>
3531
3532             <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3533
3534             <table><tr>
3535                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3536             </tr><tr>
3537     <?php       // show list of skins
3538         $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3539         while ($skinObj = sql_fetch_object($res)) {
3540             $id = 'skinexp' . $skinObj->sdnumber;
3541             echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3542             echo '<label for="',$id,'">',ENTITY::hsc($skinObj->sdname),'</label></td>';
3543             echo '<td>',ENTITY::hsc($skinObj->sddesc),'</td>';
3544             echo '</tr><tr>';
3545         }
3546
3547         echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3548
3549         // show list of templates
3550         $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3551         while ($templateObj = sql_fetch_object($res)) {
3552             $id = 'templateexp' . $templateObj->tdnumber;
3553             echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3554             echo '<label for="',$id,'">',ENTITY::hsc($templateObj->tdname),'</label></td>';
3555             echo '<td>',ENTITY::hsc($templateObj->tddesc),'</td>';
3556             echo '</tr><tr>';
3557         }
3558
3559     ?>
3560                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3561             </tr><tr>
3562                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3563             </tr><tr>
3564                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3565             </tr><tr>
3566                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3567             </tr></table>
3568         </div></form>
3569
3570     <?php
3571         $this->pagefoot();
3572
3573     }
3574
3575     /**
3576      * @todo document this
3577      */
3578     function action_skinieimport() {
3579         global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3580
3581         $member->isAdmin() or $this->disallow();
3582
3583         // load skinie class
3584         include_once($DIR_LIBS . 'skinie.php');
3585
3586         $skinFileRaw= postVar('skinfile');
3587         $mode       = postVar('mode');
3588
3589         $importer = new SKINIMPORT();
3590
3591         // get full filename
3592         if ($mode == 'file')
3593         {
3594             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3595
3596             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3597             if (!file_exists($skinFile))
3598                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3599         } else {
3600             $skinFile = $skinFileRaw;
3601         }
3602
3603         // read only metadata
3604         $error = $importer->readFile($skinFile, 1);
3605
3606         // clashes
3607         $skinNameClashes = $importer->checkSkinNameClashes();
3608         $templateNameClashes = $importer->checkTemplateNameClashes();
3609         $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3610
3611         if ($error) $this->error($error);
3612
3613         $this->pagehead();
3614
3615         echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3616         ?>
3617         <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3618
3619         <ul>
3620             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3621             <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3622             <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3623             <?php
3624                 if ($hasNameClashes)
3625                 {
3626             ?>
3627             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3628             <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3629             <?php
3630                 } // if (hasNameClashes)
3631             ?>
3632         </ul>
3633
3634         <form method="post" action="index.php"><div>
3635             <input type="hidden" name="action" value="skiniedoimport" />
3636             <?php $manager->addTicketHidden() ?>
3637             <input type="hidden" name="skinfile" value="<?php echo ENTITY::hsc(postVar('skinfile'))?>" />
3638             <input type="hidden" name="mode" value="<?php echo ENTITY::hsc($mode)?>" />
3639             <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3640             <?php
3641                 if ($hasNameClashes)
3642                 {
3643             ?>
3644             <br />
3645             <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3646             <?php
3647                 } // if (hasNameClashes)
3648             ?>
3649         </div></form>
3650
3651
3652         <?php
3653         $this->pagefoot();
3654     }
3655
3656     /**
3657      * @todo document this
3658      */
3659     function action_skiniedoimport() {
3660         global $member, $DIR_LIBS, $DIR_SKINS;
3661
3662         $member->isAdmin() or $this->disallow();
3663
3664         // load skinie class
3665         include_once($DIR_LIBS . 'skinie.php');
3666
3667         $skinFileRaw= postVar('skinfile');
3668         $mode       = postVar('mode');
3669
3670         $allowOverwrite = intPostVar('overwrite');
3671
3672         // get full filename
3673         if ($mode == 'file')
3674         {
3675             $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3676
3677             // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3678             if (!file_exists($skinFile))
3679                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3680
3681         } else {
3682             $skinFile = $skinFileRaw;
3683         }
3684
3685         $importer = new SKINIMPORT();
3686
3687         $error = $importer->readFile($skinFile);
3688
3689         if ($error)
3690             $this->error($error);
3691
3692         $error = $importer->writeToDatabase($allowOverwrite);
3693
3694         if ($error)
3695             $this->error($error);
3696
3697         $this->pagehead();
3698
3699         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3700     ?>
3701         <h2><?php echo _SKINIE_DONE?></h2>
3702
3703         <ul>
3704             <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo ENTITY::hsc($importer->getInfo())?></p></li>
3705             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3706             <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3707         </ul>
3708
3709     <?php       $this->pagefoot();
3710
3711     }
3712
3713     /**
3714      * @todo document this
3715      */
3716     function action_skinieexport() {
3717         global $member, $DIR_LIBS;
3718
3719         $member->isAdmin() or $this->disallow();
3720
3721         // load skinie class
3722         include_once($DIR_LIBS . 'skinie.php');
3723
3724         $aSkins = requestIntArray('skin');
3725         $aTemplates = requestIntArray('template');
3726
3727         if (!is_array($aTemplates)) $aTemplates = array();
3728         if (!is_array($aSkins)) $aSkins = array();
3729
3730         $skinList = array_keys($aSkins);
3731         $templateList = array_keys($aTemplates);
3732
3733         $info = postVar('info');
3734
3735         $exporter = new SKINEXPORT();
3736         foreach ($skinList as $skinId) {
3737             $exporter->addSkin($skinId);
3738         }
3739         foreach ($templateList as $templateId) {
3740             $exporter->addTemplate($templateId);
3741         }
3742         $exporter->setInfo($info);
3743
3744         $exporter->export();
3745     }
3746
3747     /**
3748      * @todo document this
3749      */
3750     function action_templateoverview() {
3751         global $member, $manager;
3752
3753         $member->isAdmin() or $this->disallow();
3754
3755         $this->pagehead();
3756
3757         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3758
3759         echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3760         echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3761
3762         $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3763         $template['content'] = 'templatelist';
3764         $template['tabindex'] = 10;
3765         showlist($query,'table',$template);
3766
3767         echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3768
3769         ?>
3770         <form method="post" action="index.php"><div>
3771
3772         <input name="action" value="templatenew" type="hidden" />
3773         <?php $manager->addTicketHidden() ?>
3774         <table><tr>
3775             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3776             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3777         </tr><tr>
3778             <td><?php echo _TEMPLATE_DESC?></td>
3779             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3780         </tr><tr>
3781             <td><?php echo _TEMPLATE_CREATE?></td>
3782             <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3783         </tr></table>
3784
3785         </div></form>
3786
3787         <?php
3788         $this->pagefoot();
3789     }
3790
3791     /**
3792      * @todo document this
3793      */
3794     function action_templateedit($msg = '') {
3795         global $member, $manager;
3796
3797         $templateid = intRequestVar('templateid');
3798
3799         $member->isAdmin() or $this->disallow();
3800
3801         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3802         $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
3803
3804         $this->pagehead($extrahead);
3805
3806         $templatename = TEMPLATE::getNameFromId($templateid);
3807         $templatedescription = TEMPLATE::getDesc($templateid);
3808         $template =& $manager->getTemplate($templatename);
3809
3810         ?>
3811         <p>
3812         <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3813         </p>
3814
3815         <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  ENTITY::hsc($templatename); ?>'</h2>
3816
3817         <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3818         ?>
3819
3820         <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3821
3822         <form method="post" action="index.php">
3823         <div>
3824
3825         <input type="hidden" name="action" value="templateupdate" />
3826         <?php $manager->addTicketHidden() ?>
3827         <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3828
3829         <table><tr>
3830             <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3831         </tr><tr>
3832             <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3833             <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  ENTITY::hsc($templatename) ?>" /></td>
3834         </tr><tr>
3835             <td><?php echo _TEMPLATE_DESC?></td>
3836             <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  ENTITY::hsc($templatedescription) ?>" /></td>
3837         </tr><tr>
3838             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3839         </tr><tr>
3840             <td><?php echo _TEMPLATE_UPDATE?></td>
3841             <td>
3842                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3843                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3844             </td>
3845         </tr><tr>
3846             <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3847 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3848     $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3849     $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3850     $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3851     $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3852     $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3853 ?>
3854         </tr><tr>
3855             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3856 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3857     $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3858     $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3859     $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3860     $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3861     $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3862     $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3863 ?>
3864         </tr><tr>
3865             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3866 <?php
3867     $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3868 ?>
3869         </tr><tr>
3870             <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3871 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3872 ?>
3873         </tr><tr>
3874             <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3875 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3876     $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3877     $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3878 ?>
3879         </tr><tr>
3880             <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3881 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3882     $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3883     $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3884 ?>
3885         </tr><tr>
3886             <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3887 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 190);
3888     $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 200);
3889     $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 210);
3890 ?>
3891         </tr><tr>
3892             <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3893 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 220);
3894     $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 230);
3895     $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 240);
3896     $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 250);
3897     $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 260);
3898 ?>
3899         </tr><tr>
3900             <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3901 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 270);
3902     $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 280);
3903     $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 290);
3904 ?>
3905         </tr><tr>
3906             <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3907 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',300);
3908     $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',310);
3909 ?>
3910         </tr><tr>
3911             <th colspan="2"><?php echo _TEMPLATE_PLUGIN_FIELDS?></th>
3912 <?php
3913         $tab = 600;
3914         $pluginfields = array();
3915         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
3916
3917         foreach ($pluginfields as $pfkey=>$pfvalue) {
3918             echo "</tr><tr>\n";
3919             echo '<th colspan="2">' . ENTITY::hen($pfkey) . "</th>\n";
3920             foreach ($pfvalue as $pffield=>$pfdesc) {
3921                 $this->_templateEditRow($template, $pfdesc, $pffield, '',++$tab,0);
3922             }
3923         }
3924 ?>
3925         </tr><tr>
3926             <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3927         </tr><tr>
3928             <td><?php echo _TEMPLATE_UPDATE?></td>
3929             <td>
3930                 <input type="submit" tabindex="800" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3931                 <input type="reset" tabindex="810" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3932             </td>
3933         </tr></table>
3934
3935         </div>
3936         </form>
3937         <?php
3938         $this->pagefoot();
3939     }
3940
3941     /**
3942      * @todo document this
3943      */
3944     function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3945         static $count = 1;
3946         if (!isset($template[$name])) $template[$name] = '';
3947     ?>
3948         </tr><tr>
3949             <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3950             <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  ENTITY::hsc($template[$name]); ?></textarea></td>
3951     <?php       $count++;
3952     }
3953
3954     /**
3955      * @todo document this
3956      */
3957     function action_templateupdate() {
3958         global $member,$manager;
3959
3960         $templateid = intRequestVar('templateid');
3961
3962         $member->isAdmin() or $this->disallow();
3963
3964         $name = postVar('tname');
3965         $desc = postVar('tdesc');
3966
3967         if (!isValidTemplateName($name))
3968             $this->error(_ERROR_BADTEMPLATENAME);
3969
3970         if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3971             $this->error(_ERROR_DUPTEMPLATENAME);
3972
3973
3974         $name = sql_real_escape_string($name);
3975         $desc = sql_real_escape_string($desc);
3976
3977         // 1. Remove all template parts
3978         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3979         sql_query($query);
3980
3981         // 2. Update description
3982         $query =  'UPDATE '.sql_table('template_desc').' SET'
3983                . " tdname='" . $name . "',"
3984                . " tddesc='" . $desc . "'"
3985                . " WHERE tdnumber=" . $templateid;
3986         sql_query($query);
3987
3988         // 3. Add non-empty template parts
3989         $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3990         $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3991         $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3992         $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3993         $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3994         $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3995         $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3996         $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3997         $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3998         $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3999         $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
4000         $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
4001         $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
4002         $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
4003         $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
4004         $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
4005         $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
4006         $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
4007         $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
4008         $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
4009         $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
4010         $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
4011         $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
4012         $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
4013         $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
4014         $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
4015         $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
4016         $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
4017         $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
4018         $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
4019         $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
4020         $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
4021         $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
4022         $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
4023
4024         $pluginfields = array();
4025         $manager->notify('TemplateExtraFields',array('fields'=>&$pluginfields));
4026         foreach ($pluginfields as $pfkey=>$pfvalue) {
4027             foreach ($pfvalue as $pffield=>$pfdesc) {
4028                 $this->addToTemplate($templateid, $pffield, postVar($pffield));
4029             }
4030         }
4031
4032         // jump back to template edit
4033         $this->action_templateedit(_TEMPLATE_UPDATED);
4034
4035     }
4036
4037     /**
4038      * @todo document this
4039      */
4040     function addToTemplate($id, $partname, $content) {
4041         $partname = sql_real_escape_string($partname);
4042         $content = sql_real_escape_string($content);
4043
4044         $id = intval($id);
4045
4046         // don't add empty parts:
4047         if (!trim($content)) return -1;
4048
4049         $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
4050                . "VALUES ($id, '$partname', '$content')";
4051         sql_query($query) or exit(_ADMIN_SQLDIE_QUERYERROR . sql_error());
4052         return sql_insert_id();
4053     }
4054
4055     /**
4056      * @todo document this
4057      */
4058     function action_templatedelete() {
4059         global $member, $manager;
4060
4061         $member->isAdmin() or $this->disallow();
4062
4063         $templateid = intRequestVar('templateid');
4064         // TODO: check if template can be deleted
4065
4066         $this->pagehead();
4067
4068         $name = TEMPLATE::getNameFromId($templateid);
4069         $desc = TEMPLATE::getDesc($templateid);
4070
4071         ?>
4072             <h2><?php echo _DELETE_CONFIRM?></h2>
4073
4074             <p>
4075             <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo ENTITY::hsc($name)?></b> (<?php echo  ENTITY::hsc($desc) ?>)
4076             </p>
4077
4078             <form method="post" action="index.php"><div>
4079                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4080                 <?php $manager->addTicketHidden() ?>
4081                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4082                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4083             </div></form>
4084         <?php
4085         $this->pagefoot();
4086     }
4087
4088     /**
4089      * @todo document this
4090      */
4091     function action_templatedeleteconfirm() {
4092         global $member, $manager;
4093
4094         $templateid = intRequestVar('templateid');
4095
4096         $member->isAdmin() or $this->disallow();
4097
4098         $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4099
4100         // 1. delete description
4101         sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4102
4103         // 2. delete parts
4104         sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4105
4106         $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4107
4108         $this->action_templateoverview();
4109     }
4110
4111     /**
4112      * @todo document this
4113      */
4114     function action_templatenew() {
4115         global $member;
4116
4117         $member->isAdmin() or $this->disallow();
4118
4119         $name = postVar('name');
4120         $desc = postVar('desc');
4121
4122         if (!isValidTemplateName($name))
4123             $this->error(_ERROR_BADTEMPLATENAME);
4124
4125         if (TEMPLATE::exists($name))
4126             $this->error(_ERROR_DUPTEMPLATENAME);
4127
4128         $newTemplateId = TEMPLATE::createNew($name, $desc);
4129
4130         $this->action_templateoverview();
4131     }
4132
4133     /**
4134      * @todo document this
4135      */
4136     function action_templateclone() {
4137         global $member;
4138
4139         $templateid = intRequestVar('templateid');
4140
4141         $member->isAdmin() or $this->disallow();
4142
4143         // 1. read old template
4144         $name = TEMPLATE::getNameFromId($templateid);
4145         $desc = TEMPLATE::getDesc($templateid);
4146
4147         // 2. create desc thing
4148         $name = "cloned" . $name;
4149
4150         // if a template with that name already exists:
4151         if (TEMPLATE::exists($name)) {
4152             $i = 1;
4153             while (TEMPLATE::exists($name . $i))
4154                 $i++;
4155             $name .= $i;
4156         }
4157
4158         $newid = TEMPLATE::createNew($name, $desc);
4159
4160         // 3. create clone
4161         // go through parts of old template and add them to the new one
4162         $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4163         while ($o = sql_fetch_object($res)) {
4164             $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4165         }
4166
4167         $this->action_templateoverview();
4168     }
4169
4170     /**
4171      * @todo document this
4172      */
4173     function action_skinoverview() {
4174         global $member, $manager;
4175
4176         $member->isAdmin() or $this->disallow();
4177
4178         $this->pagehead();
4179
4180         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4181
4182         echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4183
4184         echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4185
4186         $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4187         $template['content'] = 'skinlist';
4188         $template['tabindex'] = 10;
4189         showlist($query,'table',$template);
4190
4191         echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4192
4193         ?>
4194         <form method="post" action="index.php">
4195         <div>
4196
4197         <input name="action" value="skinnew" type="hidden" />
4198         <?php $manager->addTicketHidden() ?>
4199         <table><tr>
4200             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4201             <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4202         </tr><tr>
4203             <td><?php echo _SKIN_DESC?></td>
4204             <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4205         </tr><tr>
4206             <td><?php echo _SKIN_CREATE?></td>
4207             <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4208         </tr></table>
4209
4210         </div>
4211         </form>
4212
4213         <?php
4214         $this->pagefoot();
4215     }
4216
4217     /**
4218      * @todo document this
4219      */
4220     function action_skinnew() {
4221         global $member;
4222
4223         $member->isAdmin() or $this->disallow();
4224
4225         $name = trim(postVar('name'));
4226         $desc = trim(postVar('desc'));
4227
4228         if (!isValidSkinName($name))
4229             $this->error(_ERROR_BADSKINNAME);
4230
4231         if (SKIN::exists($name))
4232             $this->error(_ERROR_DUPSKINNAME);
4233
4234         $newId = SKIN::createNew($name, $desc);
4235
4236         $this->action_skinoverview();
4237     }
4238
4239     /**
4240      * @todo document this
4241      */
4242     function action_skinedit() {
4243         global $member, $manager;
4244
4245         $skinid = intRequestVar('skinid');
4246
4247         $member->isAdmin() or $this->disallow();
4248
4249         $skin = new SKIN($skinid);
4250
4251         $this->pagehead();
4252         ?>
4253         <p>
4254             <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4255         </p>
4256         <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4257
4258         <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4259         <?php echo _SKIN_PARTS_MSG?>
4260         <ul>
4261             <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4262             <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4263             <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4264             <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4265             <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4266             <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4267             <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4268             <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4269         </ul>
4270
4271         <?php
4272
4273         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4274         $res = sql_query($query);
4275
4276         echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4277         echo '<form method="get" action="index.php">' . "\r\n";
4278         echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4279         echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4280         echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4281         echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4282         echo '</form>' . "\r\n";
4283
4284         if ($res && sql_num_rows($res) > 0) {
4285             echo '<ul>';
4286             $tabstart = 75;
4287
4288             while ($row = sql_fetch_assoc($res)) {
4289                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">' . ENTITY::hsc(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . ENTITY::hsc(strtolower($row['stype'])) . '">remove</a>)</li>';
4290             }
4291
4292             echo '</ul>';
4293         }
4294
4295         ?>
4296
4297         <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4298         <form method="post" action="index.php">
4299         <div>
4300
4301         <input type="hidden" name="action" value="skineditgeneral" />
4302         <?php $manager->addTicketHidden() ?>
4303         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4304         <table><tr>
4305             <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4306             <td><input name="name" tabindex="90" value="<?php echo  ENTITY::hsc($skin->getName()) ?>" maxlength="20" size="20" /></td>
4307         </tr><tr>
4308             <td><?php echo _SKIN_DESC?></td>
4309             <td><input name="desc" tabindex="100" value="<?php echo  ENTITY::hsc($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4310         </tr><tr>
4311             <td><?php echo _SKIN_TYPE?></td>
4312             <td><input name="type" tabindex="110" value="<?php echo  ENTITY::hsc($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4313         </tr><tr>
4314             <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4315             <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4316         </tr><tr>
4317             <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4318             <td><input name="inc_prefix" tabindex="130" value="<?php echo  ENTITY::hsc($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4319         </tr><tr>
4320             <td><?php echo _SKIN_CHANGE?></td>
4321             <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4322         </tr></table>
4323
4324         </div>
4325         </form>
4326
4327
4328         <?php       $this->pagefoot();
4329     }
4330
4331     /**
4332      * @todo document this
4333      */
4334     function action_skineditgeneral() {
4335         global $member;
4336
4337         $skinid = intRequestVar('skinid');
4338
4339         $member->isAdmin() or $this->disallow();
4340
4341         $name = postVar('name');
4342         $desc = postVar('desc');
4343         $type = postVar('type');
4344         $inc_mode = postVar('inc_mode');
4345         $inc_prefix = postVar('inc_prefix');
4346
4347         $skin = new SKIN($skinid);
4348
4349         // 1. Some checks
4350         if (!isValidSkinName($name))
4351             $this->error(_ERROR_BADSKINNAME);
4352
4353         if (($skin->getName() != $name) && SKIN::exists($name))
4354             $this->error(_ERROR_DUPSKINNAME);
4355
4356         if (!$type) $type = 'text/html';
4357         if (!$inc_mode) $inc_mode = 'normal';
4358
4359         // 2. Update description
4360         $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4361
4362         $this->action_skinedit();
4363
4364     }
4365
4366     /**
4367      * @todo document this
4368      */
4369     function action_skinedittype($msg = '') {
4370         global $member, $manager;
4371
4372         $skinid = intRequestVar('skinid');
4373         $type = requestVar('type');
4374
4375         $member->isAdmin() or $this->disallow();
4376
4377         $type = trim($type);
4378         $type = strtolower($type);
4379
4380         if (!isValidShortName($type)) {
4381             $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4382         }
4383
4384         $skin = new SKIN($skinid);
4385
4386         $friendlyNames = SKIN::getFriendlyNames();
4387
4388         $this->pagehead();
4389         ?>
4390         <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4391
4392         <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo ENTITY::hsc($skin->getName()) ?>': <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4393
4394         <?php           if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4395         ?>
4396
4397
4398         <form method="post" action="index.php">
4399         <div>
4400
4401         <input type="hidden" name="action" value="skinupdate" />
4402         <?php $manager->addTicketHidden() ?>
4403         <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4404         <input type="hidden" name="type" value="<?php echo  $type ?>" />
4405
4406         <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4407         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4408         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4409         <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4410             help('skinpart' . $type);
4411         } else {
4412             help('skinpartspecial');
4413         }?>
4414         <br />
4415
4416         <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  ENTITY::hsc($skin->getContent($type)) ?></textarea>
4417
4418         <br />
4419         <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4420         <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4421         (skin type: <?php echo ENTITY::hsc(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4422
4423         <br /><br />
4424         <?php echo _SKIN_ALLOWEDVARS?>
4425         <?php           $actions = SKIN::getAllowedActionsForType($type);
4426
4427             sort($actions);
4428
4429             while ($current = array_shift($actions)) {
4430                 // skip deprecated vars
4431                 if ($current == 'ifcat') continue;
4432                 if ($current == 'imagetext') continue;
4433                 if ($current == 'vars') continue;
4434
4435                 echo helplink('skinvar-' . $current) . "$current</a>";
4436                 if (count($actions) != 0) echo ", ";
4437             }
4438         echo '<br /><br />' . _SKINEDIT_ALLOWEDBLOGS;
4439         $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4440         showlist($query,'table',array('content'=>'shortblognames'));
4441         echo '<br />' . _SKINEDIT_ALLOWEDTEMPLATESS;
4442         $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4443         showlist($query,'table',array('content'=>'shortnames'));
4444         echo '</div></form>';
4445         $this->pagefoot();
4446     }
4447
4448     /**
4449      * @todo document this
4450      */
4451     function action_skinupdate() {
4452         global $member;
4453
4454         $skinid = intRequestVar('skinid');
4455         $content = trim(postVar('content'));
4456         $type = postVar('type');
4457
4458         $member->isAdmin() or $this->disallow();
4459
4460         $skin = new SKIN($skinid);
4461         $skin->update($type, $content);
4462
4463         $this->action_skinedittype(_SKIN_UPDATED);
4464     }
4465
4466     /**
4467      * @todo document this
4468      */
4469     function action_skindelete() {
4470         global $member, $manager, $CONF;
4471
4472         $skinid = intRequestVar('skinid');
4473
4474         $member->isAdmin() or $this->disallow();
4475
4476         // don't allow default skin to be deleted
4477         if ($skinid == $CONF['BaseSkin'])
4478             $this->error(_ERROR_DEFAULTSKIN);
4479
4480         // don't allow deletion of default skins for blogs
4481         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4482         $r = sql_query($query);
4483         if ($o = sql_fetch_object($r))
4484             $this->error(_ERROR_SKINDEFDELETE . ENTITY::hsc($o->bname));
4485
4486         $this->pagehead();
4487
4488         $skin = new SKIN($skinid);
4489         $name = $skin->getName();
4490         $desc = $skin->getDescription();
4491
4492         ?>
4493             <h2><?php echo _DELETE_CONFIRM?></h2>
4494
4495             <p>
4496                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo ENTITY::hsc($name) ?></b> (<?php echo  ENTITY::hsc($desc)?>)
4497             </p>
4498
4499             <form method="post" action="index.php"><div>
4500                 <input type="hidden" name="action" value="skindeleteconfirm" />
4501                 <?php $manager->addTicketHidden() ?>
4502                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4503                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4504             </div></form>
4505         <?php
4506         $this->pagefoot();
4507     }
4508
4509     /**
4510      * @todo document this
4511      */
4512     function action_skindeleteconfirm() {
4513         global $member, $CONF, $manager;
4514
4515         $skinid = intRequestVar('skinid');
4516
4517         $member->isAdmin() or $this->disallow();
4518
4519         // don't allow default skin to be deleted
4520         if ($skinid == $CONF['BaseSkin'])
4521             $this->error(_ERROR_DEFAULTSKIN);
4522
4523         // don't allow deletion of default skins for blogs
4524         $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4525         $r = sql_query($query);
4526         if ($o = sql_fetch_object($r))
4527             $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4528
4529         $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4530
4531         // 1. delete description
4532         sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4533
4534         // 2. delete parts
4535         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4536
4537         $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4538
4539         $this->action_skinoverview();
4540     }
4541
4542     /**
4543      * @todo document this
4544      */
4545     function action_skinremovetype() {
4546         global $member, $manager, $CONF;
4547
4548         $skinid = intRequestVar('skinid');
4549         $skintype = requestVar('type');
4550
4551         if (!isValidShortName($skintype)) {
4552             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4553         }
4554
4555         $member->isAdmin() or $this->disallow();
4556
4557         // don't allow default skinparts to be deleted
4558         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4559             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4560         }
4561
4562         $this->pagehead();
4563
4564         $skin = new SKIN($skinid);
4565         $name = $skin->getName();
4566         $desc = $skin->getDescription();
4567
4568         ?>
4569             <h2><?php echo _DELETE_CONFIRM?></h2>
4570
4571             <p>
4572                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo ENTITY::hsc($skintype); ?> (<?php echo ENTITY::hsc($name); ?>)</b> (<?php echo  ENTITY::hsc($desc)?>)
4573             </p>
4574
4575             <form method="post" action="index.php"><div>
4576                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4577                 <?php $manager->addTicketHidden() ?>
4578                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4579                 <input type="hidden" name="type" value="<?php echo ENTITY::hsc($skintype); ?>" />
4580                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4581             </div></form>
4582         <?php
4583         $this->pagefoot();
4584     }
4585
4586     /**
4587      * @todo document this
4588      */
4589     function action_skinremovetypeconfirm() {
4590         global $member, $CONF, $manager;
4591
4592         $skinid = intRequestVar('skinid');
4593         $skintype = requestVar('type');
4594
4595         if (!isValidShortName($skintype)) {
4596             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4597         }
4598
4599         $member->isAdmin() or $this->disallow();
4600
4601         // don't allow default skinparts to be deleted
4602         if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4603             $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4604         }
4605
4606         $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4607
4608         // delete part
4609         sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4610
4611         $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4612
4613         $this->action_skinedit();
4614     }
4615
4616     /**
4617      * @todo document this
4618      */
4619     function action_skinclone() {
4620         global $member;
4621
4622         $skinid = intRequestVar('skinid');
4623
4624         $member->isAdmin() or $this->disallow();
4625
4626         // 1. read skin to clone
4627         $skin = new SKIN($skinid);
4628
4629         $name = "clone_" . $skin->getName();
4630
4631         // if a skin with that name already exists:
4632         if (SKIN::exists($name)) {
4633             $i = 1;
4634             while (SKIN::exists($name . $i))
4635                 $i++;
4636             $name .= $i;
4637         }
4638
4639         // 2. create skin desc
4640         $newid = SKIN::createNew(
4641             $name,
4642             $skin->getDescription(),
4643             $skin->getContentType(),
4644             $skin->getIncludeMode(),
4645             $skin->getIncludePrefix()
4646         );
4647
4648
4649         // 3. clone
4650         /*
4651         $this->skinclonetype($skin, $newid, 'index');
4652         $this->skinclonetype($skin, $newid, 'item');
4653         $this->skinclonetype($skin, $newid, 'archivelist');
4654         $this->skinclonetype($skin, $newid, 'archive');
4655         $this->skinclonetype($skin, $newid, 'search');
4656         $this->skinclonetype($skin, $newid, 'error');
4657         $this->skinclonetype($skin, $newid, 'member');
4658         $this->skinclonetype($skin, $newid, 'imagepopup');
4659         */
4660
4661         $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4662         $res = sql_query($query);
4663         while ($row = sql_fetch_assoc($res)) {
4664             $this->skinclonetype($skin, $newid, $row['stype']);
4665         }
4666
4667         $this->action_skinoverview();
4668
4669     }
4670
4671     /**
4672      * @todo document this
4673      */
4674     function skinclonetype($skin, $newid, $type) {
4675         $newid = intval($newid);
4676         $content = $skin->getContent($type);
4677         if ($content) {
4678             $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
4679             sql_query($query);
4680         }
4681     }
4682
4683     /**
4684      * @todo document this
4685      */
4686     function action_settingsedit() {
4687         global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4688
4689         $member->isAdmin() or $this->disallow();
4690
4691         $this->pagehead();
4692
4693         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4694         ?>
4695
4696         <h2><?php echo _SETTINGS_TITLE?></h2>
4697
4698         <form action="index.php" method="post">
4699         <div>
4700
4701         <input type="hidden" name="action" value="settingsupdate" />
4702         <?php $manager->addTicketHidden() ?>
4703
4704         <table><tr>
4705             <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4706         </tr><tr>
4707             <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4708             <td>
4709                 <?php
4710                     $query =  'SELECT bname as text, bnumber as value'
4711                            . ' FROM '.sql_table('blog');
4712                     $template['name'] = 'DefaultBlog';
4713                     $template['selected'] = $CONF['DefaultBlog'];
4714                     $template['tabindex'] = 10;
4715                     showlist($query,'select',$template);
4716                 ?>
4717             </td>
4718         </tr><tr>
4719             <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4720             <td>
4721                 <?php
4722                     $query =  'SELECT sdname as text, sdnumber as value'
4723                            . ' FROM '.sql_table('skin_desc');
4724                     $template['name'] = 'BaseSkin';
4725                     $template['selected'] = $CONF['BaseSkin'];
4726                     $template['tabindex'] = 1;
4727                     showlist($query,'select',$template);
4728                 ?>
4729             </td>
4730         </tr><tr>
4731             <td><?php echo _SETTINGS_ADMINMAIL?></td>
4732             <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminEmail']) ?>" /></td>
4733         </tr><tr>
4734             <td><?php echo _SETTINGS_SITENAME?></td>
4735             <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  ENTITY::hsc($CONF['SiteName']) ?>" /></td>
4736         </tr><tr>
4737             <td><?php echo _SETTINGS_SITEURL?></td>
4738             <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  ENTITY::hsc($CONF['IndexURL']) ?>" /></td>
4739         </tr><tr>
4740             <td><?php echo _SETTINGS_ADMINURL?></td>
4741             <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  ENTITY::hsc($CONF['AdminURL']) ?>" /></td>
4742         </tr><tr>
4743             <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4744             <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  ENTITY::hsc($CONF['PluginURL']) ?>" /></td>
4745         </tr><tr>
4746             <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4747             <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  ENTITY::hsc($CONF['SkinsURL']) ?>" /></td>
4748         </tr><tr>
4749             <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4750             <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  ENTITY::hsc($CONF['ActionURL']) ?>" /></td>
4751         </tr><tr>
4752             <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4753             </td>
4754             <td>
4755                 <select name="Language" tabindex="10050">
4756                         <?php
4757                                 $locales = i18n::get_available_locale_list();
4758                                 if ( !i18n::get_current_locale() || !in_array(i18n::get_current_locale(), $locales) )
4759                                 {
4760                                         echo "<option value=\"\" selected=\"selected\">en_Latn_US</option>\n";
4761                                 }
4762                                 else
4763                                 {
4764                                         echo "<option value=\"\">en_Latn_US</option>\n";
4765                                 }
4766
4767                                 foreach ( $locales as $locale )
4768                                 {
4769                                         if ( $locale == 'en_Latn_US' )
4770                                         {
4771                                                 continue;
4772                                         }
4773                                         if ( $locale == i18n::get_current_locale() )
4774                                         {
4775                                                 echo "<option value=\"{$locale}\" selected=\"selected\">{$locale}</option>\n";
4776                                         }
4777                                         else
4778                                         {
4779                                                 echo "<option value=\"{$locale}\">{$locale}</option>\n";
4780                                         }
4781                                 }
4782                         ?>
4783                         </select>
4784
4785             </td>
4786         </tr><tr>
4787             <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4788             </td>
4789             <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4790                     <br />
4791                 <?php echo _SETTINGS_DISABLESITEURL ?> <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  ENTITY::hsc($CONF['DisableSiteURL'])?>" />
4792             </td>
4793         </tr><tr>
4794             <td><?php echo _SETTINGS_DIRS?></td>
4795             <td><?php echo  ENTITY::hsc($DIR_NUCLEUS) ?>
4796                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4797         </tr><tr>
4798             <td><?php echo _SETTINGS_DBLOGIN?></td>
4799             <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4800         </tr><tr>
4801             <td>
4802             <?php
4803                 echo _SETTINGS_JSTOOLBAR
4804                 /* =_SETTINGS_DISABLEJS
4805
4806                     I temporary changed the meaning of DisableJsTools, until I can find a good
4807                     way to select the javascript version to use
4808
4809                     now, its:
4810                         0 : IE
4811                         1 : all javascript disabled
4812                         2 : 'simpler' javascript (for mozilla/opera/mac)
4813                 */
4814                ?>
4815             </td>
4816             <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4817                 <select name="DisableJsTools" tabindex="10075">
4818             <?php                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4819                     echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4820                     $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4821                     echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4822                     $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4823                     echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4824             ?>
4825                 </select>
4826             </td>
4827         </tr><tr>
4828             <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4829                        <td><?php
4830
4831                        $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4832                               'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4833
4834                        echo ' ', _SETTINGS_URLMODE_HELP;
4835
4836                              ?>
4837
4838                        </td>
4839         </tr><tr>
4840             <td><?php echo _SETTINGS_DEBUGVARS?> <?php help('debugvars');?></td>
4841                        <td><?php
4842
4843                         $this->input_yesno('DebugVars',$CONF['DebugVars'],10078);
4844
4845                              ?>
4846
4847                        </td>
4848         </tr><tr>
4849             <td><?php echo _SETTINGS_DEFAULTLISTSIZE?> <?php help('defaultlistsize');?></td>
4850             <td>
4851             <?php
4852                 if (!array_key_exists('DefaultListSize',$CONF)) {
4853                     sql_query("INSERT INTO ".sql_table('config')." VALUES ('DefaultListSize', '10')");
4854                     $CONF['DefaultListSize'] = 10;
4855                 }
4856             ?>
4857                 <input name="DefaultListSize" tabindex="10079" size="40" value="<?php echo  ENTITY::hsc((intval($CONF['DefaultListSize']) < 1 ? '10' : $CONF['DefaultListSize'])) ?>" />
4858             </td>
4859         </tr><tr>
4860             <td><?php echo _SETTINGS_ADMINCSS?>
4861             </td>
4862             <td>
4863
4864                 <select name="AdminCSS" tabindex="10080">
4865                 <?php               // show a dropdown list of all available admin css files
4866                 global $DIR_NUCLEUS;
4867
4868                 $dirhandle = opendir($DIR_NUCLEUS."styles/");
4869
4870                                 while ($filename = readdir($dirhandle) )
4871                                 {
4872
4873                                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
4874                                         # original ereg: ereg("^(.*)\.php$",$filename,$matches)
4875
4876                                         if (preg_match('#^admin_(.*)\.css$#', $filename, $matches) )
4877                                         {
4878
4879                                                 $name = $matches[1];
4880                                                 echo "<option value=\"$name\"";
4881
4882                                                 if ($name == $CONF['AdminCSS'])
4883                                                 {
4884                                                         echo " selected=\"selected\"";
4885                                                 }
4886
4887                                                 echo ">$name</option>";
4888
4889                                         }
4890
4891                                 }
4892
4893                                 closedir($dirhandle);
4894
4895                                 ?>
4896                                 </select>
4897
4898             </td>
4899         </tr><tr>
4900             <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4901         </tr><tr>
4902             <td><?php echo _SETTINGS_MEDIADIR?></td>
4903             <td><?php echo  ENTITY::hsc($DIR_MEDIA) ?>
4904                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4905                 <?php                   if (!is_dir($DIR_MEDIA))
4906                         echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4907                     if (!is_readable($DIR_MEDIA))
4908                         echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4909                     if (!is_writeable($DIR_MEDIA))
4910                         echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4911                 ?>
4912             </td>
4913         </tr><tr>
4914             <td><?php echo _SETTINGS_MEDIAURL?></td>
4915             <td>
4916                 <input name="MediaURL" tabindex="10090" size="40" value="<?php echo  ENTITY::hsc($CONF['MediaURL']) ?>" />
4917             </td>
4918         </tr><tr>
4919             <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4920             <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4921         </tr><tr>
4922             <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4923             <td>
4924                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  ENTITY::hsc($CONF['AllowedTypes']) ?>" />
4925             </td>
4926         </tr><tr>
4927             <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4928             <td>
4929                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  ENTITY::hsc($CONF['MaxUploadSize']) ?>" />
4930             </td>
4931         </tr><tr>
4932             <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4933             <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4934
4935         </tr><tr>
4936             <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4937         </tr><tr>
4938             <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4939             <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4940         </tr><tr>
4941             <td><?php echo _SETTINGS_ALLOWCREATE?>
4942                 <?php help('allowaccountcreation'); ?>
4943             </td>
4944             <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4945             </td>
4946         </tr><tr>
4947             <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4948                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4949             </td>
4950             <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4951             </td>
4952         </tr><tr>
4953             <td><?php echo _SETTINGS_MEMBERMSGS?>
4954                 <?php help('messageservice'); ?>
4955             </td>
4956             <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4957             </td>
4958         </tr><tr>
4959             <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4960                 <?php help('messageservice'); ?>
4961             </td>
4962             <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4963             </td>
4964         </tr><tr>
4965             <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4966                 <?php help('protectmemnames'); ?>
4967             </td>
4968             <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4969             </td>
4970
4971
4972
4973         </tr><tr>
4974             <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4975         </tr><tr>
4976             <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4977             <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePrefix'])?>" /></td>
4978         </tr><tr>
4979             <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4980             <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  ENTITY::hsc($CONF['CookieDomain'])?>" /></td>
4981         </tr><tr>
4982             <td><?php echo _SETTINGS_COOKIEPATH?></td>
4983             <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  ENTITY::hsc($CONF['CookiePath'])?>" /></td>
4984         </tr><tr>
4985             <td><?php echo _SETTINGS_COOKIESECURE?></td>
4986             <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4987         </tr><tr>
4988             <td><?php echo _SETTINGS_COOKIELIFE?></td>
4989             <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4990                               1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4991             </td>
4992         </tr><tr>
4993             <td><?php echo _SETTINGS_LASTVISIT?></td>
4994             <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4995
4996
4997
4998         </tr><tr>
4999             <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
5000         </tr><tr>
5001             <td><?php echo _SETTINGS_UPDATE?></td>
5002             <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
5003         </tr></table>
5004
5005         </div>
5006         </form>
5007
5008         <?php
5009             echo '<h2>',_PLUGINS_EXTRA,'</h2>';
5010
5011             $manager->notify(
5012                 'GeneralSettingsFormExtras',
5013                 array()
5014             );
5015
5016         $this->pagefoot();
5017     }
5018
5019         /**
5020          * ADMIN::action_settingsupdate()
5021          * Update $CONFIG and redirect
5022          *
5023          * @param       void
5024          * @return      void
5025          */
5026         function action_settingsupdate() {
5027                 global $member, $CONF;
5028
5029                 $member->isAdmin() or $this->disallow();
5030
5031                 // check if email address for admin is valid
5032                 if ( !NOTIFICATION::address_validation(postVar('AdminEmail')) )
5033                 {
5034                         $this->error(_ERROR_BADMAILADDRESS);
5035                 }
5036
5037                 // save settings
5038                 $this->updateConfig('DefaultBlog',        postVar('DefaultBlog'));
5039                 $this->updateConfig('BaseSkin',          postVar('BaseSkin'));
5040                 $this->updateConfig('IndexURL',          postVar('IndexURL'));
5041                 $this->updateConfig('AdminURL',          postVar('AdminURL'));
5042                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
5043                 $this->updateConfig('SkinsURL',          postVar('SkinsURL'));
5044                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
5045                 $this->updateConfig('Language',            postVar('Language'));
5046                 $this->updateConfig('AdminEmail',          postVar('AdminEmail'));
5047                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
5048                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
5049                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
5050                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
5051                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
5052                 $this->updateConfig('SiteName',          postVar('SiteName'));
5053                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
5054                 $this->updateConfig('DisableSite',        postVar('DisableSite'));
5055                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
5056                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
5057                 $this->updateConfig('MediaURL',          postVar('MediaURL'));
5058                 $this->updateConfig('AllowedTypes',      postVar('AllowedTypes'));
5059                 $this->updateConfig('AllowUpload',        postVar('AllowUpload'));
5060                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
5061                 $this->updateConfig('MediaPrefix',        postVar('MediaPrefix'));
5062                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
5063                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
5064                 $this->updateConfig('CookieDomain',      postVar('CookieDomain'));
5065                 $this->updateConfig('CookiePath',          postVar('CookiePath'));
5066                 $this->updateConfig('CookieSecure',      postVar('CookieSecure'));
5067                 $this->updateConfig('URLMode',            postVar('URLMode'));
5068                 $this->updateConfig('CookiePrefix',      postVar('CookiePrefix'));
5069                 $this->updateConfig('DebugVars',                        postVar('DebugVars'));
5070                 $this->updateConfig('DefaultListSize',            postVar('DefaultListSize'));
5071                 $this->updateConfig('AdminCSS',           postVar('AdminCSS'));
5072
5073                 // load new config and redirect (this way, the new language will be used is necessary)
5074                 // note that when changing cookie settings, this redirect might cause the user
5075                 // to have to log in again.
5076                 getConfig();
5077                 redirect($CONF['AdminURL'] . '?action=manage');
5078                 exit;
5079         }
5080
5081         /**
5082          * ADMIN::action_systemoverview()
5083          * Output system overview
5084          *
5085          * @param       void
5086          * @return      void
5087          */
5088         function action_systemoverview()
5089         {
5090                 global $member, $nucleus, $CONF;
5091
5092                 $this->pagehead();
5093
5094                 echo '<h2>' . _ADMIN_SYSTEMOVERVIEW_HEADING . "</h2>\n";
5095
5096                 if ( $member->isLoggedIn() && $member->isAdmin() )
5097                 {
5098                         // Information about the used PHP and MySQL installation
5099                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_PHPANDMYSQL . "</h3>\n\n";
5100
5101                         // Version of PHP MySQL
5102                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "\" class=\"systemoverview\">\n";
5103                         echo "<thead>\n";
5104                         echo "<tr>\n";
5105                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_VERSIONS . "</th>\n";
5106                         echo "</tr>\n";
5107                         echo "</thead>\n";
5108                         echo "<tbody>\n";
5109                         echo "<tr>\n";
5110                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_PHPVERSION . "</td>\n";
5111                         echo '<td>' . phpversion() . "</td>\n";
5112                         echo "</tr>\n";
5113                         echo "<tr>\n";
5114                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_MYSQLVERSION . "</td>\n";
5115                         echo '<td>' . sql_get_server_info() . ' (' . sql_get_client_info() . ')' . "</td>\n";
5116                         echo "</tr>\n";
5117                         echo "</tbody>\n";
5118                         echo "</table>\n\n";
5119
5120                         // Important PHP settings
5121                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "\" class=\"systemoverview\">\n";
5122                         echo "<thead>\n";
5123                         echo "<tr>\n";
5124                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_SETTINGS . "</th>\n";
5125                         echo "</tr>\n";
5126                         echo "</thead>\n";
5127                         echo "<tbody>\n";
5128                         echo "<tr>\n";
5129                         echo '<td>magic_quotes_gpc' . "</td>\n";
5130                         $mqg = get_magic_quotes_gpc() ? 'On' : 'Off';
5131                         echo '<td>' . $mqg . "</td>\n";
5132                         echo "</tr>\n";
5133                         echo "<tr>\n";
5134                         echo '<td>magic_quotes_runtime' . "</td>\n";
5135                         $mqr = get_magic_quotes_runtime() ? 'On' : 'Off';
5136                         echo '<td>' . $mqr . "</td>\n";
5137                         echo "</tr>\n";
5138                         echo "<tr>\n";
5139                         echo '<td>register_globals' . "</td>\n";
5140                         $rg = ini_get('register_globals') ? 'On' : 'Off';
5141                         echo '<td>' . $rg . "</td>\n";
5142                         echo "</tr>\n";
5143                         echo "</tbody>\n";
5144                         echo "</table>\n\n";
5145
5146                         // Information about GD library
5147                         $gdinfo = gd_info();
5148                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "\" class=\"systemoverview\">\n";
5149                         echo "<thead>\n";
5150                         echo "<tr>\n";
5151                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_GDLIBRALY . "</th>\n";
5152                         echo "</tr>\n";
5153                         echo "</thead>\n";
5154                         echo "<tbody>\n";
5155                         foreach ( $gdinfo as $key=>$value )
5156                         {
5157                                 if ( is_bool($value) )
5158                                 {
5159                                         $value = $value ? _ADMIN_SYSTEMOVERVIEW_ENABLE : _ADMIN_SYSTEMOVERVIEW_DISABLE;
5160                                 }
5161                                 else
5162                                 {
5163                                         $value = ENTITY::hsc($value);
5164                                 }
5165                                 echo "<tr>\n";
5166                                 echo '<td>' . $key . "</td>\n";
5167                                 echo '<td>' . $value . "</td>\n";
5168                                 echo "</tr>\n";
5169                         }
5170                         echo "</tbody>\n";
5171                         echo "</table>\n\n";
5172
5173                         // Check if special modules are loaded
5174                         ob_start();
5175                         phpinfo(INFO_MODULES);
5176                         $im = ob_get_contents();
5177                         ob_clean();
5178                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_MODULES . "\" class=\"systemoverview\">\n";
5179                         echo "<thead>\n";
5180                         echo "<tr>";
5181                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_MODULES . "</th>\n";
5182                         echo "</tr>\n";
5183                         echo "<tbody>\n";
5184                         echo "<tr>\n";
5185                         echo '<td>mod_rewrite' . "</td>\n";
5186                         $modrewrite = (strstr($im, 'mod_rewrite') != '') ?
5187                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5188                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5189                         echo '<td>' . $modrewrite . "</td>\n";
5190                         echo "</tr>\n";
5191                         echo "</tbody>\n";
5192                         echo "</table>\n\n";
5193
5194                         // Information about the used Nucleus CMS
5195                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSYSTEM . "</h3>\n";
5196                         global $nucleus;
5197                         $nv = getNucleusVersion() / 100 . '(' . $nucleus['version'] . ')';
5198                         $np = getNucleusPatchLevel();
5199                         echo "<table frame=\"box\" rules=\"all\" summary=\"Nucleus CMS\" class=\"systemoverview\" class=\"systemoverview\">\n";
5200                         echo "<thead>\n";
5201                         echo "<tr>\n";
5202                         echo '<th colspan="2">Nucleus CMS' . "</th>\n";
5203                         echo "</tr>\n";
5204                         echo "</thead>\n";
5205                         echo "<tbody>\n";
5206                         echo "<tr>\n";
5207                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSVERSION . "</td>\n";
5208                         echo '<td>' . $nv . "</td>\n";
5209                         echo "</tr>\n";
5210                         echo "<tr>\n";
5211                         echo '<td>' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSPATCHLEVEL . "</td>\n";
5212                         echo '<td>' . $np . "</td>\n";
5213                         echo "</tr>\n";
5214                         echo "</tbody>\n";
5215                         echo "</table>\n\n";
5216
5217                         // Important settings of the installation
5218                         echo '<table frame="box" rules="all" summary="' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "\" class=\"systemoverview\">\n";
5219                         echo "<thead>\n";
5220                         echo "<tr>\n";
5221                         echo '<th colspan="2">' . _ADMIN_SYSTEMOVERVIEW_NUCLEUSSETTINGS . "</th>\n";
5222                         echo "</tr>\n";
5223                         echo "</thead>\n";
5224                         echo "<tbody>\n";
5225                         echo "<tr>\n";
5226                         echo '<td>' . '$CONF[' . "'Self']</td>\n";
5227                         echo '<td>' . $CONF['Self'] . "</td>\n";
5228                         echo "</tr>\n";
5229                         echo "<tr>\n";
5230                         echo '<td>' . '$CONF[' . "'ItemURL']</td>\n";
5231                         echo '<td>' . $CONF['ItemURL'] . "</td>\n";
5232                         echo "</tr>\n";
5233                         echo "<tr>\n";
5234                         echo '<td>' . '$CONF[' . "'alertOnHeadersSent']</td>\n";
5235                         $ohs = $CONF['alertOnHeadersSent'] ?
5236                                                 _ADMIN_SYSTEMOVERVIEW_ENABLE :
5237                                                 _ADMIN_SYSTEMOVERVIEW_DISABLE;
5238                         echo '<td>' . $ohs . "</td>\n";
5239                         echo "</tr>\n";
5240                         echo "<tr>\n";
5241                         echo "<td>i18n::get_current_charset()</td>\n";
5242                         echo '<td>' . i18n::get_current_charset() . "</td>\n";
5243                         echo "</tr>\n";
5244                         echo "</tbody>\n";
5245                         echo "</table>\n\n";
5246
5247                         // Link to the online version test at the Nucleus CMS website
5248                         echo '<h3>' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK . "</h3>\n";
5249                         if ( $nucleus['codename'] != '')
5250                         {
5251                                 $codenamestring = ' &quot;' . $nucleus['codename'] . '&quot;';
5252                         }
5253                         else
5254                         {
5255                                 $codenamestring = '';
5256                         }
5257                         echo _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TXT;
5258                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5259                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">';
5260                         echo 'Nucleus CMS ' . $nv . $codenamestring;
5261                         echo '</a>';
5262                 }
5263                 else
5264                 {
5265                         echo _ADMIN_SYSTEMOVERVIEW_NOT_ADMIN;
5266                 }
5267                 $this->pagefoot();
5268         }
5269
5270         /**
5271          * ADMIN::updateConfig()
5272          *
5273          * @param       string  $name
5274          * @param       string  $val
5275          * @return      integer return the ID in which the latest query posted
5276          */
5277         function updateConfig($name, $val)
5278         {
5279                 $name = sql_real_escape_string($name);
5280                 $val = trim(sql_real_escape_string($val));
5281
5282                 $query = "UPDATE %s SET value='%s' WHERE name='%s'";
5283                 $query = sprintf($query, sql_table('config'), $val, $name);
5284                 sql_query($query) or die("Query error: " . sql_error());
5285                 return sql_insert_id();
5286         }
5287
5288         /**
5289          * Error message
5290          * @param string $msg message that will be shown
5291          */
5292         function error($msg)
5293         {
5294                 $this->pagehead();
5295
5296                 echo "<h2>Error!</h2>\n";
5297                 echo $msg;
5298                 echo "<br />\n";
5299                 echo '<a href="index.php" onclick="history.back()">' . _BACK . "</a>\n";
5300                 $this->pagefoot();
5301                 exit;
5302         }
5303
5304         /**
5305          * ADMIN::disallow()
5306          * add error log and show error page
5307          *
5308          * @param       void
5309          * @return      void
5310          */
5311         function disallow()
5312         {
5313                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
5314                 $this->error(_ERROR_DISALLOWED);
5315         }
5316
5317         /**
5318          * ADMIN::pagehead()
5319          * Output admin page head
5320          *
5321          * @param       void
5322          * @return      void
5323          */
5324         function pagehead($extrahead = '')
5325         {
5326                 global $member, $nucleus, $CONF, $manager;
5327
5328                 $manager->notify(
5329                         'AdminPrePageHead',
5330                         array(
5331                                 'extrahead' => &$extrahead,
5332                                 'action' => $this->action));
5333
5334                 $baseUrl = ENTITY::hsc($CONF['AdminURL']);
5335                 if ( !array_key_exists('AdminCSS',$CONF) )
5336                 {
5337                         sql_query("INSERT INTO ".sql_table('config')." VALUES ('AdminCSS', 'original')");
5338                         $CONF['AdminCSS'] = 'original';
5339                 }
5340
5341                 /* HTTP 1.1 application for no caching */
5342                 header("Cache-Control: no-cache, must-revalidate");
5343                 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
5344
5345                 $root_element = 'html';
5346                 $charset = i18n::get_current_charset();
5347                 $locale = preg_replace('#_#', '-', i18n::get_current_locale());
5348
5349                 echo "<?xml version=\"{$this->xml_version_info}\" encoding=\"{$charset}\" ?>\n";
5350                 echo "<!DOCTYPE {$root_element} PUBLIC \"{$this->formal_public_identifier}\" \"{$this->system_identifier}\">\n";
5351                 echo "<{$root_element} xmlns=\"{$this->xhtml_namespace}\" xml:lang=\"{$locale}\" lang=\"{$locale}\">\n";
5352                 echo "<head>\n";
5353                 echo '<title>' . ENTITY::hsc($CONF['SiteName']) . " - Admin</title>\n";
5354                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/admin_{$CONF["AdminCSS"]}.css\" />\n";
5355                 echo "<link rel=\"stylesheet\" title=\"Nucleus Admin Default\" type=\"text/css\" href=\"{$baseUrl}styles/addedit.css\" />\n";
5356                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/edit.js\"></script>\n";
5357                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/admin.js\"></script>\n";
5358                 echo "<script type=\"text/javascript\" src=\"{$baseUrl}javascript/compatibility.js\"></script>\n";
5359                 echo "{$extrahead}\n";
5360                 echo "</head>\n\n";
5361                 echo "<body>\n";
5362                 echo "<div id=\"adminwrapper\">\n";
5363                 echo "<div class=\"header\">\n";
5364                 echo '<h1>' . ENTITY::hsc($CONF['SiteName']) . "</h1>\n";
5365                 echo "</div>\n";
5366                 echo "<div id=\"container\">\n";
5367                 echo "<div id=\"content\">\n";
5368                 echo "<div class=\"loginname\">\n";
5369                 if ( $member->isLoggedIn() )
5370                 {
5371                         echo _LOGGEDINAS . ' ' . $member->getDisplayName() ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a><br />\n";
5372                         echo "<a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5373                 }
5374                 else
5375                 {
5376                         echo '<a href="index.php?action=showlogin" title="Log in">' . _NOTLOGGEDIN . "</a><br />\n";
5377                 }
5378                 echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a><br />\n";
5379                 echo '(';
5380
5381                 if (array_key_exists('codename', $nucleus) && $nucleus['codename'] != '' )
5382                 {
5383                         $codenamestring = ' &quot;' . $nucleus['codename'].'&quot;';
5384                 }
5385                 else
5386                 {
5387                         $codenamestring = '';
5388                 }
5389
5390                 if ( $member->isLoggedIn() && $member->isAdmin() )
5391                 {
5392                         $checkURL = sprintf(_ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_URL, getNucleusVersion(), getNucleusPatchLevel());
5393                         echo '<a href="' . $checkURL . '" title="' . _ADMIN_SYSTEMOVERVIEW_VERSIONCHECK_TITLE . '">Nucleus CMS ' . $nucleus['version'] . $codenamestring . '</a>';
5394
5395                         $newestVersion = getLatestVersion();
5396                         $newestCompare = str_replace('/','.',$newestVersion);
5397                         $currentVersion = str_replace(array('/','v'),array('.',''),$nucleus['version']);
5398                         if ( $newestVersion && version_compare($newestCompare, $currentVersion) > 0 )
5399                         {
5400                                 echo "<br />\n";
5401                                 echo '<a style="color:red" href="http://nucleuscms.org/upgrade.php" title="' . _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TITLE . '">';
5402                                 echo _ADMIN_SYSTEMOVERVIEW_LATESTVERSION_TEXT . $newestVersion;
5403                                 echo "</a>";
5404                         }
5405                 }
5406                 else
5407                 {
5408                         echo 'Nucleus CMS ' . $nucleus['version'] . $codenamestring;
5409                 }
5410                 echo ')';
5411                 echo '</div>';
5412                 return;
5413         }
5414
5415         /**
5416          * ADMIN::pagefoot()
5417          * Output admin page foot include quickmenu
5418          *
5419          * @param       void
5420          * @return      void
5421          */
5422         function pagefoot()
5423         {
5424                 global $action, $member, $manager;
5425
5426                 $manager->notify(
5427                         'AdminPrePageFoot',
5428                         array('action' => $this->action)
5429                 );
5430
5431                 if ( $member->isLoggedIn() && ($action != 'showlogin') )
5432                 {
5433                         echo '<h2>' . _LOGOUT . "</h2>\n";
5434                         echo "<ul>\n";
5435                         echo '<li><a href="index.php?action=overview">' . _BACKHOME . "</a></li>\n";
5436                         echo '<li><a href="index.php?action=logout">' .  _LOGOUT . "</a></li>\n";
5437                         echo "</ul>\n";
5438                 }
5439
5440                 echo "<div class=\"foot\">\n";
5441                 echo '<a href="' . _ADMINPAGEFOOT_OFFICIALURL . '">Nucleus CMS</a> &copy; 2002-' . date('Y') . ' ' . _ADMINPAGEFOOT_COPYRIGHT;
5442                 echo '-';
5443                 echo '<a href="' . _ADMINPAGEFOOT_DONATEURL . '">' . _ADMINPAGEFOOT_DONATE . "</a>\n";
5444                 echo "</div>\n";
5445
5446                 echo "<!-- content -->\n";
5447                 echo "<div id=\"quickmenu\">\n";
5448
5449                 if ( ($action != 'showlogin') && ($member->isLoggedIn()) )
5450                 {
5451                         echo "<ul>\n";
5452                         echo '<li><a href="index.php?action=overview">' . _QMENU_HOME . "</a></li>\n";
5453                         echo "</ul>\n";
5454
5455                         echo '<h2>' . _QMENU_ADD . "</h2>\n";
5456                         echo "<form method=\"get\" action=\"index.php\">\n";
5457                         echo "<p>\n";
5458                         echo "<input type=\"hidden\" name=\"action\" value=\"createitem\" />\n";
5459
5460                         $showAll = requestVar('showall');
5461
5462                         if ( ($member->isAdmin()) && ($showAll == 'yes') )
5463                         {
5464                                 // Super-Admins have access to all blogs! (no add item support though)
5465                                 $query =  'SELECT bnumber as value, bname as text'
5466                                                 . ' FROM ' . sql_table('blog')
5467                                                 . ' ORDER BY bname';
5468                         }
5469                         else
5470                         {
5471                                 $query =  'SELECT bnumber as value, bname as text'
5472                                                 . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5473                                                 . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5474                                                 . ' ORDER BY bname';
5475                         }
5476                         $template['name'] = 'blogid';
5477                         $template['tabindex'] = 15000;
5478                         $template['extra'] = _QMENU_ADD_SELECT;
5479                         $template['selected'] = -1;
5480                         $template['shorten'] = 10;
5481                         $template['shortenel'] = '';
5482                         $template['javascript'] = 'onchange="return form.submit()"';
5483                         showlist($query,'select',$template);
5484
5485                         echo "</p>\n";
5486                         echo "</form>\n";
5487
5488                         echo "<h2>{$member->getDisplayName()}</h2>\n";
5489                         echo "<ul>\n";
5490                         echo '<li><a href="index.php?action=editmembersettings">' . _QMENU_USER_SETTINGS . "</a></li>\n";
5491                         echo '<li><a href="index.php?action=browseownitems">' . _QMENU_USER_ITEMS . "</a></li>\n";
5492                         echo '<li><a href="index.php?action=browseowncomments">' . _QMENU_USER_COMMENTS . "</a></li>\n";
5493                         echo "</ul>\n";
5494
5495                         // ---- general settings ----
5496                         if ( $member->isAdmin() )
5497                         {
5498                                 echo '<h2>' . _QMENU_MANAGE . "</h2>\n";
5499                                 echo "<ul>\n";
5500                                 echo '<li><a href="index.php?action=actionlog">' . _QMENU_MANAGE_LOG . "</a></li>\n";
5501                                 echo '<li><a href="index.php?action=settingsedit">' . _QMENU_MANAGE_SETTINGS . "</a></li>\n";
5502                                 echo '<li><a href="index.php?action=systemoverview">' . _QMENU_MANAGE_SYSTEM . "</a></li>\n";
5503                                 echo '<li><a href="index.php?action=usermanagement">' . _QMENU_MANAGE_MEMBERS . "</a></li>\n";
5504                                 echo '<li><a href="index.php?action=createnewlog">' . _QMENU_MANAGE_NEWBLOG . "</a></li>\n";
5505                                 echo '<li><a href="index.php?action=backupoverview">' . _QMENU_MANAGE_BACKUPS . "</a></li>\n";
5506                                 echo '<li><a href="index.php?action=pluginlist">' . _QMENU_MANAGE_PLUGINS . "</a></li>\n";
5507                                 echo "</ul>\n";
5508
5509                                 echo "<h2>" . _QMENU_LAYOUT . "</h2>\n";
5510                                 echo "<ul>\n";
5511                                 echo '<li><a href="index.php?action=skinoverview">' . _QMENU_LAYOUT_SKINS . "</a></li>\n";
5512                                 echo '<li><a href="index.php?action=templateoverview">' . _QMENU_LAYOUT_TEMPL . "</a></li>\n";
5513                                 echo '<li><a href="index.php?action=skinieoverview">' . _QMENU_LAYOUT_IEXPORT . "</a></li>\n";
5514                                 echo "</ul>\n";
5515                         }
5516
5517                         $aPluginExtras = array();
5518                         $manager->notify(
5519                                 'QuickMenu',
5520                                 array(
5521                                         'options' => &$aPluginExtras));
5522
5523                         if ( count($aPluginExtras) > 0 )
5524                         {
5525                                 echo "<h2>" . _QMENU_PLUGINS . "</h2>\n";
5526                                 echo "<ul>\n";
5527                                 foreach ( $aPluginExtras as $aInfo )
5528                                 {
5529                                         echo '<li><a href="' . ENTITY::hsc($aInfo['url']) . '" title="' . ENTITY::hsc($aInfo['tooltip']) . '">' . ENTITY::hsc($aInfo['title']) . "</a></li>\n";
5530                                 }
5531                                 echo "</ul>\n";
5532                         }
5533                 }
5534                 else if ( ($action == 'activate') || ($action == 'activatesetpwd') )
5535                 {
5536
5537                         echo '<h2>' . _QMENU_ACTIVATE . '</h2>' . _QMENU_ACTIVATE_TEXT;
5538                 }
5539                 else
5540                 {
5541                         // introduction text on login screen
5542                         echo '<h2>' . _QMENU_INTRO . '</h2>' . _QMENU_INTRO_TEXT;
5543                 }
5544
5545                 echo "<!-- quickmenu -->\n";
5546                 echo "</div>\n";
5547
5548                 echo "<!-- content -->\n";
5549                 echo "</div>\n";
5550
5551                 echo "<!-- container -->\n";
5552                 echo "</div>\n";
5553
5554                 echo "<!-- adminwrapper -->\n";
5555                 echo "</div>\n";
5556
5557                 echo "</body>\n";
5558                 echo "</html>\n";
5559                 return;
5560         }
5561
5562     /**
5563      * @todo document this
5564      */
5565     function action_regfile() {
5566         global $member, $CONF;
5567
5568         $blogid = intRequestVar('blogid');
5569
5570         $member->teamRights($blogid) or $this->disallow();
5571
5572         // header-code stolen from phpMyAdmin
5573         // REGEDIT and bookmarklet code stolen from GreyMatter
5574
5575         $sjisBlogName = sprintf(_WINREGFILE_TEXT, getBlogNameFromID($blogid));
5576
5577
5578         header('Content-Type: application/octetstream');
5579         header('Content-Disposition: filename="nucleus.reg"');
5580         header('Pragma: no-cache');
5581         header('Expires: 0');
5582
5583         echo "REGEDIT4\n";
5584         echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\" . $sjisBlogName . "]\n";
5585         echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5586         echo '"contexts"=hex:31';
5587     }
5588
5589     /**
5590      * @todo document this
5591      */
5592     function action_bookmarklet() {
5593         global $member, $manager;
5594
5595         $blogid = intRequestVar('blogid');
5596
5597         $member->teamRights($blogid) or $this->disallow();
5598
5599         $blog =& $manager->getBlog($blogid);
5600         $bm = getBookmarklet($blogid);
5601
5602         $this->pagehead();
5603
5604         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5605
5606         ?>
5607
5608         <h2><?php echo _BOOKMARKLET_TITLE ?></h2>
5609
5610         <p>
5611         <?php echo _BOOKMARKLET_DESC1 . _BOOKMARKLET_DESC2 . _BOOKMARKLET_DESC3 . _BOOKMARKLET_DESC4 . _BOOKMARKLET_DESC5 ?>
5612         </p>
5613
5614         <h3><?php echo _BOOKMARKLET_BOOKARKLET ?></h3>
5615         <p>
5616             <?php echo _BOOKMARKLET_BMARKTEXT ?><small><?php echo _BOOKMARKLET_BMARKTEST ?></small>
5617             <br />
5618             <br />
5619             <?php echo '<a href="' . ENTITY::hsc($bm) . '">' . sprintf(_BOOKMARKLET_ANCHOR, ENTITY::hsc($blog->getName())) . '</a>' . _BOOKMARKLET_BMARKFOLLOW; ?>
5620         </p>
5621
5622         <h3><?php echo _BOOKMARKLET_RIGHTCLICK ?></h3>
5623         <p>
5624             <?php
5625                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5626                 $url = $manager->addTicketToUrl($url);
5627             ?>
5628             <?php echo _BOOKMARKLET_RIGHTTEXT1 . '<a href="' . ENTITY::hsc($url, ENT_QUOTES, "SJIS") . '">' . _BOOKMARKLET_RIGHTLABEL . '</a>' . _BOOKMARKLET_RIGHTTEXT2; ?>
5629         </p>
5630
5631         <p>
5632             <?php echo _BOOKMARKLET_RIGHTTEXT3 ?>
5633         </p>
5634
5635         <h3><?php echo _BOOKMARKLET_UNINSTALLTT ?></h3>
5636         <p>
5637             <?php echo _BOOKMARKLET_DELETEBAR ?>
5638         </p>
5639
5640         <p>
5641             <?php echo _BOOKMARKLET_DELETERIGHTT ?>
5642         </p>
5643
5644         <ol>
5645             <li><?php echo _BOOKMARKLET_DELETERIGHT1 ?></li>
5646             <li><?php echo _BOOKMARKLET_DELETERIGHT2 ?></li>
5647             <li><?php echo _BOOKMARKLET_DELETERIGHT3 ?></li>
5648             <li><?php echo _BOOKMARKLET_DELETERIGHT4 ?></li>
5649             <li><?php echo _BOOKMARKLET_DELETERIGHT5 ?></li>
5650         </ol>
5651
5652         <?php
5653         $this->pagefoot();
5654
5655     }
5656
5657     /**
5658      * @todo document this
5659      */
5660     function action_actionlog() {
5661         global $member, $manager;
5662
5663         $member->isAdmin() or $this->disallow();
5664
5665         $this->pagehead();
5666
5667         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5668
5669         $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5670
5671         ?>
5672             <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5673             <p><a href="<?php echo ENTITY::hsc($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5674         <?php
5675         echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5676
5677         $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5678         $template['content'] = 'actionlist';
5679         $amount = showlist($query,'table',$template);
5680
5681         $this->pagefoot();
5682
5683     }
5684
5685     /**
5686      * @todo document this
5687      */
5688     function action_banlist() {
5689         global $member, $manager;
5690
5691         $blogid = intRequestVar('blogid');
5692
5693         $member->blogAdminRights($blogid) or $this->disallow();
5694
5695         $blog =& $manager->getBlog($blogid);
5696
5697         $this->pagehead();
5698
5699         echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5700
5701         echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5702
5703         $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5704         $template['content'] = 'banlist';
5705         $amount = showlist($query,'table',$template);
5706
5707         if ($amount == 0)
5708             echo _BAN_NONE;
5709
5710         echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5711         echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5712
5713
5714         $this->pagefoot();
5715
5716     }
5717
5718     /**
5719      * @todo document this
5720      */
5721     function action_banlistdelete() {
5722         global $member, $manager;
5723
5724         $blogid = intRequestVar('blogid');
5725         $iprange = requestVar('iprange');
5726
5727         $member->blogAdminRights($blogid) or $this->disallow();
5728
5729         $blog =& $manager->getBlog($blogid);
5730         $banBlogName =  ENTITY::hsc($blog->getName());
5731
5732         $this->pagehead();
5733         ?>
5734             <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5735
5736             <form method="post" action="index.php">
5737
5738             <h3><?php echo _BAN_IPRANGE?></h3>
5739
5740             <p>
5741                 <?php echo _CONFIRMTXT_BAN?> <?php echo ENTITY::hsc($iprange) ?>
5742                 <input name="iprange" type="hidden" value="<?php echo ENTITY::hsc($iprange)?>" />
5743             </p>
5744
5745             <h3><?php echo _BAN_BLOGS?></h3>
5746
5747             <div>
5748                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5749                 <input name="allblogs" type="radio" value="0" id="allblogs_one" />
5750                 <label for="allblogs_one"><?php echo sprintf(_BAN_BANBLOGNAME, $banBlogName) ?></label>
5751                 <br />
5752                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5753             </div>
5754
5755             <h3><?php echo _BAN_DELETE_TITLE?></h3>
5756
5757             <div>
5758                 <?php $manager->addTicketHidden() ?>
5759                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5760                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5761             </div>
5762
5763             </form>
5764         <?php
5765         $this->pagefoot();
5766     }
5767
5768     /**
5769      * @todo document this
5770      */
5771     function action_banlistdeleteconfirm() {
5772         global $member, $manager;
5773
5774         $blogid = intPostVar('blogid');
5775         $allblogs = postVar('allblogs');
5776         $iprange = postVar('iprange');
5777
5778         $member->blogAdminRights($blogid) or $this->disallow();
5779
5780         $deleted = array();
5781
5782         if (!$allblogs) {
5783             if (BAN::removeBan($blogid, $iprange))
5784                 array_push($deleted, $blogid);
5785         } else {
5786             // get blogs fot which member has admin rights
5787             $adminblogs = $member->getAdminBlogs();
5788             foreach ($adminblogs as $blogje) {
5789                 if (BAN::removeBan($blogje, $iprange))
5790                     array_push($deleted, $blogje);
5791             }
5792         }
5793
5794         if (sizeof($deleted) == 0)
5795             $this->error(_ERROR_DELETEBAN);
5796
5797         $this->pagehead();
5798
5799         echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5800         echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5801         echo "<p>"._BAN_REMOVED_TEXT."</p>";
5802
5803         echo "<ul>";
5804         foreach ($deleted as $delblog) {
5805             $b =& $manager->getBlog($delblog);
5806             echo "<li>" . ENTITY::hsc($b->getName()). "</li>";
5807         }
5808         echo "</ul>";
5809
5810         $this->pagefoot();
5811
5812     }
5813
5814     /**
5815      * @todo document this
5816      */
5817     function action_banlistnewfromitem() {
5818         $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5819     }
5820
5821     /**
5822      * @todo document this
5823      */
5824     function action_banlistnew($blogid = '') {
5825         global $member, $manager;
5826
5827         if ($blogid == '')
5828             $blogid = intRequestVar('blogid');
5829
5830         $ip = requestVar('ip');
5831
5832         $member->blogAdminRights($blogid) or $this->disallow();
5833
5834         $blog =& $manager->getBlog($blogid);
5835
5836         $this->pagehead();
5837         ?>
5838         <h2><?php echo _BAN_ADD_TITLE?></h2>
5839
5840
5841         <form method="post" action="index.php">
5842
5843         <h3><?php echo _BAN_IPRANGE?></h3>
5844
5845         <p><?php echo _BAN_IPRANGE_TEXT?></p>
5846
5847         <div class="note">
5848             <strong><?php echo _BAN_EXAMPLE_TITLE ?></strong>
5849             <?php echo _BAN_EXAMPLE_TEXT ?>
5850         </div>
5851
5852         <div>
5853         <?php
5854         if ($ip) {
5855             $iprangeVal = ENTITY::hsc($ip);
5856         ?>
5857             <input name="iprange" type="radio" value="<?php echo $iprangeVal ?>" checked="checked" id="ip_fixed" />
5858             <label for="ip_fixed"><?php echo $iprangeVal ?></label>
5859             <br />
5860             <input name="iprange" type="radio" value="custom" id="ip_custom" />
5861             <label for="ip_custom"><?php echo _BAN_IP_CUSTOM ?></label>
5862             <input name='customiprange' value='<?php echo $iprangeVal ?>' maxlength='15' size='15' />
5863         <?php
5864         } else {
5865             echo "<input name='iprange' value='custom' type='hidden' />";
5866             echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5867         }
5868         ?>
5869         </div>
5870
5871         <h3><?php echo _BAN_BLOGS?></h3>
5872
5873         <p><?php echo _BAN_BLOGS_TEXT?></p>
5874
5875         <div>
5876             <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5877             <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo ENTITY::hsc($blog->getName())?>'</label>
5878             <br />
5879             <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5880         </div>
5881
5882         <h3><?php echo _BAN_REASON_TITLE?></h3>
5883
5884         <p><?php echo _BAN_REASON_TEXT?></p>
5885
5886         <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5887
5888         <h3><?php echo _BAN_ADD_TITLE?></h3>
5889
5890         <div>
5891             <input name="action" type="hidden" value="banlistadd" />
5892             <?php $manager->addTicketHidden() ?>
5893             <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5894         </div>
5895
5896         </form>
5897
5898         <?php       $this->pagefoot();
5899     }
5900
5901     /**
5902      * @todo document this
5903      */
5904     function action_banlistadd() {
5905         global $member;
5906
5907         $blogid =       intPostVar('blogid');
5908         $allblogs =     postVar('allblogs');
5909         $iprange =      postVar('iprange');
5910         if ($iprange == "custom")
5911             $iprange = postVar('customiprange');
5912         $reason =       postVar('reason');
5913
5914         $member->blogAdminRights($blogid) or $this->disallow();
5915
5916         // TODO: check IP range validity
5917
5918         if (!$allblogs) {
5919             if (!BAN::addBan($blogid, $iprange, $reason))
5920                 $this->error(_ERROR_ADDBAN);
5921         } else {
5922             // get blogs fot which member has admin rights
5923             $adminblogs = $member->getAdminBlogs();
5924             $failed = 0;
5925             foreach ($adminblogs as $blogje) {
5926                 if (!BAN::addBan($blogje, $iprange, $reason))
5927                     $failed = 1;
5928             }
5929             if ($failed)
5930                 $this->error(_ERROR_ADDBAN);
5931         }
5932
5933         $this->action_banlist();
5934
5935     }
5936
5937     /**
5938      * @todo document this
5939      */
5940     function action_clearactionlog() {
5941         global $member;
5942
5943         $member->isAdmin() or $this->disallow();
5944
5945         ACTIONLOG::clear();
5946
5947         $this->action_manage(_MSG_ACTIONLOGCLEARED);
5948     }
5949
5950     /**
5951      * @todo document this
5952      */
5953     function action_backupoverview() {
5954         global $member, $manager;
5955
5956         $member->isAdmin() or $this->disallow();
5957
5958         $this->pagehead();
5959
5960         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5961         ?>
5962         <h2><?php echo _BACKUPS_TITLE?></h2>
5963
5964         <h3><?php echo _BACKUP_TITLE?></h3>
5965
5966         <p><?php echo _BACKUP_INTRO?></p>
5967
5968         <form method="post" action="index.php"><p>
5969         <input type="hidden" name="action" value="backupcreate" />
5970         <?php $manager->addTicketHidden() ?>
5971
5972         <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5973         <br />
5974         <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5975         <br /><br />
5976         <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5977
5978         </p></form>
5979
5980         <div class="note"><?php echo _BACKUP_NOTE?></div>
5981
5982
5983         <h3><?php echo _RESTORE_TITLE?></h3>
5984
5985         <div class="note"><?php echo _RESTORE_NOTE?></div>
5986
5987         <p><?php echo _RESTORE_INTRO?></p>
5988
5989         <form method="post" action="index.php" enctype="multipart/form-data"><p>
5990             <input type="hidden" name="action" value="backuprestore" />
5991             <?php $manager->addTicketHidden() ?>
5992             <input name="backup_file" type="file" tabindex="30" />
5993             <br /><br />
5994             <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5995             <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5996             <br /><?php echo _RESTORE_WARNING?>
5997         </p></form>
5998
5999         <?php       $this->pagefoot();
6000     }
6001
6002     /**
6003      * @todo document this
6004      */
6005     function action_backupcreate() {
6006         global $member, $DIR_LIBS;
6007
6008         $member->isAdmin() or $this->disallow();
6009
6010         // use compression ?
6011         $useGzip = intval(postVar('gzip'));
6012
6013         include($DIR_LIBS . 'backup.php');
6014
6015         // try to extend time limit
6016         // (creating/restoring dumps might take a while)
6017         @set_time_limit(1200);
6018
6019         $bu = new Backup();
6020         $bu->do_backup($useGzip);
6021         exit;
6022     }
6023
6024     /**
6025      * @todo document this
6026      */
6027     function action_backuprestore() {
6028         global $member, $DIR_LIBS;
6029
6030         $member->isAdmin() or $this->disallow();
6031
6032         if (intPostVar('letsgo') != 1)
6033             $this->error(_ERROR_BACKUP_NOTSURE);
6034
6035         include($DIR_LIBS . 'backup.php');
6036
6037         // try to extend time limit
6038         // (creating/restoring dumps might take a while)
6039         @set_time_limit(1200);
6040
6041         $bu = new Backup();
6042         $message = $bu->do_restore();
6043         if ($message != '')
6044             $this->error($message);
6045
6046         $this->pagehead();
6047         ?>
6048         <h2><?php echo _RESTORE_COMPLETE?></h2>
6049         <?php       $this->pagefoot();
6050
6051     }
6052
6053     /**
6054      * @todo document this
6055      */
6056     function action_pluginlist() {
6057         global $member, $manager;
6058
6059         // check if allowed
6060         $member->isAdmin() or $this->disallow();
6061
6062         $this->pagehead();
6063
6064         echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
6065
6066         echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
6067
6068         echo '<h3>' , _PLUGS_TITLE_INSTALLED , ' &nbsp;&nbsp;<span style="font-size:smaller">', helplink('getplugins'), _PLUGS_TITLE_GETPLUGINS, '</a></span></h3>';
6069
6070
6071         $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
6072
6073         $template['content'] = 'pluginlist';
6074         $template['tabindex'] = 10;
6075         showlist($query, 'table', $template);
6076
6077 ?>
6078                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
6079
6080                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
6081
6082                         <form method="post" action="index.php"><div>
6083                                 <input type="hidden" name="action" value="pluginupdate" />
6084                                 <?php $manager->addTicketHidden() ?>
6085                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
6086                         </div></form>
6087
6088                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
6089
6090 <?php
6091                 // find a list of possibly non-installed plugins
6092                 $candidates = array();
6093
6094                 global $DIR_PLUGINS;
6095
6096                 $dirhandle = opendir($DIR_PLUGINS);
6097
6098                 while ($filename = readdir($dirhandle) )
6099                 {
6100
6101                         # replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
6102                         # original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
6103
6104                         if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
6105                         {
6106
6107                                 $name = $matches[1];
6108                                 // only show in list when not yet installed
6109                                 $res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
6110
6111                                 if (sql_num_rows($res) == 0)
6112                                 {
6113                                         array_push($candidates, $name);
6114                                 }
6115
6116                         }
6117
6118                 }
6119
6120                 closedir($dirhandle);
6121
6122                 if (sizeof($candidates) > 0)
6123                 {
6124 ?>
6125                         <p><?php echo _PLUGS_ADD_TEXT?></p>
6126
6127                         <form method='post' action='index.php'><div>
6128                                 <input type='hidden' name='action' value='pluginadd' />
6129                                 <?php $manager->addTicketHidden() ?>
6130                                 <select name="filename" tabindex="30">
6131 <?php
6132                         foreach($candidates as $name)
6133                         {
6134                                 echo '<option value="NP_',$name,'">',ENTITY::hsc($name),'</option>';
6135                         }
6136 ?>
6137                                 </select>
6138                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
6139                         </div></form>
6140
6141 <?php
6142                 }
6143                 else
6144                 {
6145                         echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
6146                 }
6147
6148                 $this->pagefoot();
6149
6150         }
6151
6152     /**
6153      * @todo document this
6154      */
6155     function action_pluginhelp() {
6156         global $member, $manager, $DIR_PLUGINS, $CONF;
6157
6158         // check if allowed
6159         $member->isAdmin() or $this->disallow();
6160
6161         $plugid = intGetVar('plugid');
6162
6163         if (!$manager->pidInstalled($plugid))
6164             $this->error(_ERROR_NOSUCHPLUGIN);
6165
6166         $plugName = getPluginNameFromPid($plugid);
6167
6168         $this->pagehead();
6169
6170         echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
6171
6172         echo '<h2>',_PLUGS_HELP_TITLE,': ',ENTITY::hsc($plugName),'</h2>';
6173
6174         $plug =& $manager->getPlugin($plugName);
6175         $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
6176
6177         if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
6178             @readfile($helpFile);
6179         } else {
6180             echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
6181             echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
6182         }
6183
6184
6185         $this->pagefoot();
6186     }
6187
6188     /**
6189      * @todo document this
6190      */
6191     function action_pluginadd() {
6192         global $member, $manager, $DIR_PLUGINS;
6193
6194         // check if allowed
6195         $member->isAdmin() or $this->disallow();
6196
6197         $name = postVar('filename');
6198
6199         if ($manager->pluginInstalled($name))
6200             $this->error(_ERROR_DUPPLUGIN);
6201         if (!checkPlugin($name))
6202             $this->error(_ERROR_PLUGFILEERROR . ' (' . ENTITY::hsc($name) . ')');
6203
6204         // get number of currently installed plugins
6205         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6206         $numCurrent = sql_num_rows($res);
6207
6208         // plugin will be added as last one in the list
6209         $newOrder = $numCurrent + 1;
6210
6211         $manager->notify(
6212             'PreAddPlugin',
6213             array(
6214                 'file' => &$name
6215             )
6216         );
6217
6218         // do this before calling getPlugin (in case the plugin id is used there)
6219         $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
6220         sql_query($query);
6221         $iPid = sql_insert_id();
6222
6223         $manager->clearCachedInfo('installedPlugins');
6224
6225         // Load the plugin for condition checking and instalation
6226         $plugin =& $manager->getPlugin($name);
6227
6228         // check if it got loaded (could have failed)
6229         if (!$plugin)
6230         {
6231             sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
6232             $manager->clearCachedInfo('installedPlugins');
6233             $this->error(_ERROR_PLUGIN_LOAD);
6234         }
6235
6236         // check if plugin needs a newer Nucleus version
6237         if (getNucleusVersion() < $plugin->getMinNucleusVersion())
6238         {
6239             // uninstall plugin again...
6240             $this->deleteOnePlugin($plugin->getID());
6241
6242             // ...and show error
6243             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc($plugin->getMinNucleusVersion()));
6244         }
6245
6246         // check if plugin needs a newer Nucleus version
6247         if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
6248         {
6249             // uninstall plugin again...
6250             $this->deleteOnePlugin($plugin->getID());
6251
6252             // ...and show error
6253             $this->error(_ERROR_NUCLEUSVERSIONREQ . ENTITY::hsc( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
6254         }
6255
6256         $pluginList = $plugin->getPluginDep();
6257         foreach ($pluginList as $pluginName)
6258         {
6259
6260             $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
6261             if (sql_num_rows($res) == 0)
6262             {
6263                 // uninstall plugin again...
6264                 $this->deleteOnePlugin($plugin->getID());
6265
6266                 $this->error(sprintf(_ERROR_INSREQPLUGIN, ENTITY::hsc($pluginName)));
6267             }
6268         }
6269
6270         // call the install method of the plugin
6271         $plugin->install();
6272
6273         $manager->notify(
6274             'PostAddPlugin',
6275             array(
6276                 'plugin' => &$plugin
6277             )
6278         );
6279
6280         // update all events
6281         $this->action_pluginupdate();
6282     }
6283
6284     /**
6285      * @todo document this
6286      */
6287     function action_pluginupdate() {
6288         global $member, $manager, $CONF;
6289
6290         // check if allowed
6291         $member->isAdmin() or $this->disallow();
6292
6293         // delete everything from plugin_events
6294         sql_query('DELETE FROM '.sql_table('plugin_event'));
6295
6296         // loop over all installed plugins
6297         $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
6298         while($o = sql_fetch_object($res)) {
6299             $pid = $o->pid;
6300             $plug =& $manager->getPlugin($o->pfile);
6301             if ($plug)
6302             {
6303                 $eventList = $plug->getEventList();
6304                 foreach ($eventList as $eventName)
6305                     sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
6306             }
6307         }
6308
6309         redirect($CONF['AdminURL'] . '?action=pluginlist');
6310 //              $this->action_pluginlist();
6311     }
6312
6313     /**
6314      * @todo document this
6315      */
6316     function action_plugindelete() {
6317         global $member, $manager;
6318
6319         // check if allowed
6320         $member->isAdmin() or $this->disallow();
6321
6322         $pid = intGetVar('plugid');
6323
6324         if (!$manager->pidInstalled($pid))
6325             $this->error(_ERROR_NOSUCHPLUGIN);
6326
6327         $this->pagehead();
6328         ?>
6329             <h2><?php echo _DELETE_CONFIRM?></h2>
6330
6331             <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
6332
6333             <form method="post" action="index.php"><div>
6334             <?php $manager->addTicketHidden() ?>
6335             <input type="hidden" name="action" value="plugindeleteconfirm" />
6336             <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
6337             <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
6338             </div></form>
6339         <?php
6340         $this->pagefoot();
6341     }
6342
6343     /**
6344      * @todo document this
6345      */
6346     function action_plugindeleteconfirm() {
6347         global $member, $manager, $CONF;
6348
6349         // check if allowed
6350         $member->isAdmin() or $this->disallow();
6351
6352         $pid = intPostVar('plugid');
6353
6354         $error = $this->deleteOnePlugin($pid, 1);
6355         if ($error) {
6356             $this->error($error);
6357         }
6358
6359         redirect($CONF['AdminURL'] . '?action=pluginlist');
6360 //              $this->action_pluginlist();
6361     }
6362
6363     /**
6364      * @todo document this
6365      */
6366     function deleteOnePlugin($pid, $callUninstall = 0) {
6367         global $manager;
6368
6369         $pid = intval($pid);
6370
6371         if (!$manager->pidInstalled($pid))
6372             return _ERROR_NOSUCHPLUGIN;
6373
6374         $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
6375
6376 /*              // call the unInstall method of the plugin
6377         if ($callUninstall) {
6378             $plugin =& $manager->getPlugin($name);
6379             if ($plugin) $plugin->unInstall();
6380         }*/
6381
6382         // check dependency before delete
6383         $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
6384         while($o = sql_fetch_object($res)) {
6385             $plug =& $manager->getPlugin($o->pfile);
6386             if ($plug)
6387             {
6388                 $depList = $plug->getPluginDep();
6389                 foreach ($depList as $depName)
6390                 {
6391                     if ($name == $depName)
6392                     {
6393                         return sprintf(_ERROR_DELREQPLUGIN, $o->pfile);
6394                     }
6395                 }
6396             }
6397         }
6398
6399         $manager->notify('PreDeletePlugin', array('plugid' => $pid));
6400
6401         // call the unInstall method of the plugin
6402         if ($callUninstall) {
6403             $plugin =& $manager->getPlugin($name);
6404             if ($plugin) $plugin->unInstall();
6405         }
6406
6407         // delete all subscriptions
6408         sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
6409
6410         // delete all options
6411         // get OIDs from plugin_option_desc
6412         $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
6413         $aOIDs = array();
6414         while ($o = sql_fetch_object($res)) {
6415             array_push($aOIDs, $o->oid);
6416         }
6417
6418         // delete from plugin_option and plugin_option_desc
6419         sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6420         if (count($aOIDs) > 0)
6421             sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6422
6423         // update order numbers
6424         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6425         $o = sql_fetch_object($res);
6426         sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6427
6428         // delete row
6429         sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6430
6431         $manager->clearCachedInfo('installedPlugins');
6432         $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6433
6434         return '';
6435     }
6436
6437     /**
6438      * @todo document this
6439      */
6440     function action_pluginup() {
6441         global $member, $manager, $CONF;
6442
6443         // check if allowed
6444         $member->isAdmin() or $this->disallow();
6445
6446         $plugid = intGetVar('plugid');
6447
6448         if (!$manager->pidInstalled($plugid))
6449             $this->error(_ERROR_NOSUCHPLUGIN);
6450
6451         // 1. get old order number
6452         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6453         $o = sql_fetch_object($res);
6454         $oldOrder = $o->porder;
6455
6456         // 2. calculate new order number
6457         $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6458
6459         // 3. update plug numbers
6460         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6461         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6462
6463         //$this->action_pluginlist();
6464         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6465         redirect($CONF['AdminURL'] . '?action=pluginlist');
6466     }
6467
6468     /**
6469      * @todo document this
6470      */
6471     function action_plugindown() {
6472         global $member, $manager, $CONF;
6473
6474         // check if allowed
6475         $member->isAdmin() or $this->disallow();
6476
6477         $plugid = intGetVar('plugid');
6478         if (!$manager->pidInstalled($plugid))
6479             $this->error(_ERROR_NOSUCHPLUGIN);
6480
6481         // 1. get old order number
6482         $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6483         $o = sql_fetch_object($res);
6484         $oldOrder = $o->porder;
6485
6486         $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6487         $maxOrder = sql_num_rows($res);
6488
6489         // 2. calculate new order number
6490         $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6491
6492         // 3. update plug numbers
6493         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6494         sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6495
6496         //$this->action_pluginlist();
6497         // To avoid showing ticket in the URL, redirect to pluginlist, instead.
6498         redirect($CONF['AdminURL'] . '?action=pluginlist');
6499     }
6500
6501         /**
6502          * ADMIN::action_pluginoptions()
6503          *
6504          * Output Plugin option page
6505          *
6506          * @access      public
6507          * @param       string $message message when fallbacked
6508          * @return      void
6509          *
6510          */
6511         public function action_pluginoptions($message = '')
6512         {
6513                 global $member, $manager;
6514
6515                 // check if allowed
6516                 $member->isAdmin() or $this->disallow();
6517
6518                 $pid = (integer) requestVar('plugid');
6519                 if ( !$manager->pidInstalled($pid) )
6520                 {
6521                         $this->error(_ERROR_NOSUCHPLUGIN);
6522                 }
6523
6524                 $pname = getPluginNameFromPid($pid);
6525
6526                 /* just for including translation */
6527                 $manager->getPlugin($pname);
6528
6529                 $extrahead = "<script type=\"text/javascript\" src=\"javascript/numbercheck.js\"></script>\n";
6530                 $this->pagehead($extrahead);
6531                 echo '<p><a href="index.php?action=pluginlist">(' . _PLUGS_BACK . ")</a></p>\n";
6532                 echo '<h2>' . sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($pname)) . "</h2>\n";
6533
6534                 if ( isset($message) )
6535                 {
6536                         echo $message;
6537                 }
6538
6539                 echo "<form action=\"index.php\" method=\"post\">\n";
6540                 echo "<div>\n";
6541                 echo "<input type=\"hidden\" name=\"action\" value=\"pluginoptionsupdate\" />\n";
6542                 echo "<input type=\"hidden\" name=\"plugid\" value=\"{$pid}\" />\n";
6543                 $manager->addTicketHidden();
6544
6545                 $aOptions = array();
6546                 $aOIDs = array();
6547                 $query = "SELECT * FROM %s WHERE ocontext='global' and opid=%d ORDER BY oid ASC";
6548                 $query = sprintf($query, sql_table('plugin_option_desc'), $pid);
6549                 $result = sql_query($query);
6550                 while ( $object = sql_fetch_object($result) )
6551                 {
6552                         array_push($aOIDs, $object->oid);
6553                         $aOptions[$object->oid] = array(
6554                                                 'oid' => $object->oid,
6555                                                 'value' => $object->odef,
6556                                                 'name' => $object->oname,
6557                                                 'description' => $object->odesc,
6558                                                 'type' => $object->otype,
6559                                                 'typeinfo' => $object->oextra,
6560                                                 'contextid' => 0
6561                         );
6562                 }
6563                 // fill out actual values
6564                 if ( count($aOIDs) > 0 )
6565                 {
6566                         $query = "SELECT oid, ovalue FROM %s WHERE oid in (%s)";
6567                         $query = sprintf($query, sql_table('plugin_option'), implode(',',$aOIDs));
6568                         $result = sql_query($query);
6569                         while ( $object = sql_fetch_object($result) )
6570                         {
6571                                 $aOptions[$object->oid]['value'] = $object->ovalue;
6572                         }
6573                 }
6574
6575                 // call plugins
6576                 $data = array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions);
6577                 $manager->notify('PrePluginOptionsEdit',$data);
6578
6579                 $template['content'] = 'plugoptionlist';
6580                 $amount = showlist($aOptions,'table',$template);
6581                 if ( $amount == 0 )
6582                 {
6583                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6584                 }
6585                 echo "</div>\n";
6586                 echo "</form>\n";
6587                 $this->pagefoot();
6588
6589                 return;
6590         }
6591
6592         /**
6593          * ADMIN::action_pluginoptionsupdate()
6594          *
6595          * Update plugin options and fallback to plugin option page
6596          *
6597          * @access      public
6598          * @param       void
6599          * @return      void
6600          */
6601         public function action_pluginoptionsupdate()
6602         {
6603                 global $member, $manager;
6604
6605                 // check if allowed
6606                 $member->isAdmin() or $this->disallow();
6607
6608                 $pid = (integer) requestVar('plugid');
6609                 if ( !$manager->pidInstalled($pid) )
6610                 {
6611                         $this->error(_ERROR_NOSUCHPLUGIN);
6612                 }
6613
6614                 $aOptions = requestArray('plugoption');
6615                 NucleusPlugin::apply_plugin_options($aOptions);
6616
6617                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6618
6619                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6620                 return;
6621         }
6622
6623         /**
6624          * ADMIN::_insertPluginOptions()
6625          *
6626          * Output plugin option field
6627          *
6628          * @access      public
6629          * @param string        $context        plugin option context
6630          * @param integer       $contextid      plugin option context id
6631          * @return      void
6632          */
6633         public function _insertPluginOptions($context, $contextid = 0)
6634         {
6635                 // get all current values for this contextid
6636                 // (note: this might contain doubles for overlapping contextids)
6637                 $aIdToValue = array();
6638                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6639                 while ( $object = sql_fetch_object($res) )
6640                 {
6641                         $aIdToValue[$object->oid] = $object->ovalue;
6642                 }
6643
6644                 // get list of oids per pid
6645                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6646                            . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
6647                 $res = sql_query($query);
6648                 $aOptions = array();
6649                 while ( $object = sql_fetch_object($res) )
6650                 {
6651                         if (in_array($object->oid, array_keys($aIdToValue)))
6652                         {
6653                                 $value = $aIdToValue[$object->oid];
6654                         }
6655                         else
6656                         {
6657                                 $value = $object->odef;
6658                         }
6659
6660                         array_push($aOptions, array(
6661                                 'pid' => $object->pid,
6662                                 'pfile' => $object->pfile,
6663                                 'oid' => $object->oid,
6664                                 'value' => $value,
6665                                 'name' => $object->oname,
6666                                 'description' => $object->odesc,
6667                                 'type' => $object->otype,
6668                                 'typeinfo' => $object->oextra,
6669                                 'contextid' => $contextid,
6670                                 'extra' => ''));
6671                 }
6672
6673                 global $manager;
6674                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6675
6676                 $iPrevPid = -1;
6677                 foreach ($aOptions as $aOption)
6678                 {
6679                         // new plugin?
6680                         if ( $iPrevPid != $aOption['pid'] )
6681                         {
6682                                 $iPrevPid = $aOption['pid'];
6683                                 if ( !defined('_PLUGIN_OPTIONS_TITLE') )
6684                                 {
6685                                         define('_PLUGIN_OPTIONS_TITLE', 'Options for %s');
6686                                 }
6687                                 echo '<tr><th colspan="2">'.sprintf(_PLUGIN_OPTIONS_TITLE, ENTITY::hsc($aOption['pfile'])).'</th></tr>';
6688                         }
6689
6690                         $meta = NucleusPlugin::getOptionMeta($aOption['typeinfo']);
6691                         if ( @$meta['access'] != 'hidden' )
6692                         {
6693                                 echo '<tr>';
6694                                 listplug_plugOptionRow($aOption);
6695                                 echo '</tr>';
6696                         }
6697                 }
6698                 return;
6699         }
6700
6701         /**
6702          * ADMIN::input_yesno()
6703          * Output input elements with radio attribute for yes/no options
6704          *
6705          * @param       string  $name   name attribute
6706          * @param       string  $value_current  current value attribute
6707          * @param       integer $tabindex       tab index
6708          * @param       string  $value_yes      value attribute for yes option
6709          * @param       string  $value_no       value attribute for no option
6710          * @param       string  $text_yes       child text element for yes option
6711          * @param       string  $text_no        child text element for no option
6712          * @param       boolean $isAdmin        have admin right or not
6713          * @return      void
6714          */
6715         function input_yesno($name, $value_current, $tabindex = 0, $value_yes = 1, $value_no = 0, $text_yes = _YES, $text_no = _NO, $isAdmin = 0)
6716         {
6717                 $id = preg_replace('#\[|\]#', '-', $name);
6718                 $id_yes = $id . $value_yes;
6719                 $id_no  = $id . $value_no;
6720
6721                 /* yes option */
6722                 echo '<input type="radio" id="' . ENTITY::hsc($id_yes) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_yes) . '"';
6723                 if ( $name=="admin" )
6724                 {
6725                         echo ' onclick="selectCanLogin(true);"';
6726                 }
6727                 if ( $value_current == $value_yes )
6728                 {
6729                         echo " tabindex='$tabindex' checked='checked'";
6730                 }
6731                 echo " />\n";
6732                 echo '<label for="' . ENTITY::hsc($id_yes) . '">' . ENTITY::hsc($text_yes) . "</label>\n";
6733
6734                 /* no option */
6735                 echo '<input type="radio" id="' . ENTITY::hsc($id_no) . '" name="' . ENTITY::hsc($name) . '" value="' . ENTITY::hsc($value_no) . '"';
6736                 if ( $name=="admin" )
6737                 {
6738                         echo ' onclick="selectCanLogin(false);"';
6739                 }
6740                 if ( $value_current != $value_yes )
6741                 {
6742                         echo " tabindex='$tabindex' checked='checked'";
6743                 }
6744                 if ($isAdmin && $name=="canlogin")
6745                 {
6746                         echo ' disabled="disabled"';
6747                 }
6748                 echo " />\n";
6749                 echo '<label for="' . ENTITY::hsc($id_no) . '">' . ENTITY::hsc($text_no) . "</label>\n";
6750
6751                 return;
6752         }
6753 }