utf8/nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2007 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2007 The Nucleus Group
  17  * @version $Id: ADMIN.php,v 1.22 2007-05-10 08:38:33 kimitake Exp $
  18  * @version $NucleusJP: ADMIN.php,v 1.21 2007/04/27 19:05:53 kimitake Exp $
  19  */
  20
  21 if ( !function_exists('requestVar') ) exit;
  22 require_once dirname(__FILE__) . '/showlist.php';
  23
  24 /**
  25  * Builds the admin area and executes admin actions
  26  */
  27 class ADMIN {
  28
  29         /**
  30          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  31          */
  32         var $action;
  33
  34         /**
  35          * Class constructor
  36          */
  37         function ADMIN() {
  38
  39         }
  40
  41         /**
  42          * Executes an action
  43          *
  44          * @param string $action action to be performed
  45          */
  46         function action($action) {
  47                 global $CONF, $manager;
  48
  49                 // list of action aliases
  50                 $alias = array(
  51                         'login' => 'overview',
  52                         '' => 'overview'
  53                 );
  54
  55                 if (isset($alias[$action]))
  56                         $action = $alias[$action];
  57
  58                 $methodName = 'action_' . $action;
  59
  60                 $this->action = strtolower($action);
  61
  62                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  63                 // is an action that requires user interaction before something is actually done)
  64                 // all safe actions are in this array:
  65                 $aActionsNotToCheck = array('showlogin', 'login', 'overview', 'itemlist', 'blogcommentlist', 'bookmarklet', 'blogsettings', 'banlist', 'deleteblog', 'editmembersettings', 'browseownitems', 'browseowncomments', 'createitem', 'itemedit', 'itemmove', 'categoryedit', 'categorydelete', 'manage', 'actionlog', 'settingsedit', 'backupoverview', 'pluginlist', 'createnewlog', 'usermanagement', 'skinoverview', 'templateoverview', 'skinieoverview', 'itemcommentlist', 'commentedit', 'commentdelete', 'banlistnewfromitem', 'banlistdelete', 'itemdelete', 'manageteam', 'teamdelete', 'banlistnew', 'memberedit', 'memberdelete', 'pluginhelp', 'pluginoptions', 'plugindelete', 'skinedittype', 'skinremovetype', 'skindelete', 'skinedit', 'templateedit', 'templatedelete', 'activate');
  66 /*
  67                 // the rest of the actions needs to be checked
  68                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');
  69 */
  70                 if (!in_array($this->action, $aActionsNotToCheck))
  71                 {
  72                         if (!$manager->checkTicket())
  73                                 $this->error(_ERROR_BADTICKET);
  74                 }
  75
  76                 if (method_exists($this, $methodName))
  77                         call_user_func(array(&$this, $methodName));
  78                 else
  79                         $this->error(_BADACTION . htmlspecialchars(" ($action)"));
  80
  81         }
  82
  83         /**
  84          * @todo document this
  85          */
  86         function action_showlogin() {
  87                 global $error;
  88                 $this->action_login($error);
  89         }
  90
  91         /**
  92          * @todo document this
  93          */
  94         function action_login($msg = '', $passvars = 1) {
  95                 global $member;
  96
  97                 // skip to overview when allowed
  98                 if ($member->isLoggedIn() && $member->canLogin()) {
  99                         $this->action_overview();
 100                         exit;
 101                 }
 102
 103                 $this->pagehead();
 104
 105                 echo '<h2>', _LOGIN ,'</h2>';
 106                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);
 107                 ?>
 108
 109                 <form action="index.php" method="post"><p>
 110                 <?php echo _LOGIN_NAME?>: <br /><input name="login"  tabindex="10" />
 111                 <br />
 112                 <?php echo _LOGIN_PASSWORD?>: <br /><input name="password"  tabindex="20" type="password" />
 113                 <br />
 114                 <input name="action" value="login" type="hidden" />
 115                 <br />
 116                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 117                 <br />
 118                 <small>
 119                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 120                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 121                 </small>
 122                 <?php                   // pass through vars
 123
 124                         $oldaction = postVar('oldaction');
 125                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 126                                 passRequestVars();
 127                         }
 128
 129
 130                 ?>
 131                 </p></form>
 132                 <?php           $this->pagefoot();
 133         }
 134
 135
 136         /**
 137          * provides a screen with the overview of the actions available
 138          * @todo document parameter
 139          */
 140         function action_overview($msg = '') {
 141                 global $member;
 142
 143                 $this->pagehead();
 144
 145                 if ($msg)
 146                         echo _MESSAGE , ': ', $msg;
 147
 148                 /* ---- add items ---- */
 149                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 150
 151                 $showAll = requestVar('showall');
 152
 153                 if (($member->isAdmin()) && ($showAll == 'yes')) {
 154                         // Super-Admins have access to all blogs! (no add item support though)
 155                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 156                                    . ' FROM ' . sql_table('blog')
 157                                    . ' ORDER BY bname';
 158                 } else {
 159                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 160                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 161                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 162                                    . ' ORDER BY bname';
 163                 }
 164                 $template['content'] = 'bloglist';
 165                 $template['superadmin'] = $member->isAdmin();
 166                 $amount = showlist($query,'table',$template);
 167
 168                 if (($showAll != 'yes') && ($member->isAdmin())) {
 169                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 170                         if ($total > $amount)
 171                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">Show all blogs</a></p>';
 172                 }
 173
 174                 if ($amount == 0)
 175                         echo _OVERVIEW_NOBLOGS;
 176
 177                 if ($amount != 0) {
 178                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 179                         $query =  'SELECT ititle, inumber, bshortname'
 180                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 181                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 182                         $template['content'] = 'draftlist';
 183                         $amountdrafts = showlist($query, 'table', $template);
 184                         if ($amountdrafts == 0)
 185                                 echo _OVERVIEW_NODRAFTS;
 186                 }
 187
 188                 /* ---- user settings ---- */
 189                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 190                 echo '<ul>';
 191                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 192                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 193                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 194                 echo '</ul>';
 195
 196                 /* ---- general settings ---- */
 197                 if ($member->isAdmin()) {
 198                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 199                         echo '<ul>';
 200                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 201                         echo '</ul>';
 202                 }
 203
 204
 205                 $this->pagefoot();
 206         }
 207
 208         /**
 209          * Returns a link to a weblog
 210          * @param object BLOG
 211          */
 212         function bloglink(&$blog) {
 213                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'. htmlspecialchars( $blog->getName() ) .'</a>';
 214         }
 215
 216         /**
 217          * @todo document this
 218          */
 219         function action_manage($msg = '') {
 220                 global $member;
 221
 222                 $member->isAdmin() or $this->disallow();
 223
 224                 $this->pagehead();
 225
 226                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 227
 228                 if ($msg)
 229                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 230
 231
 232                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 233
 234                 echo '<ul>';
 235                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 236                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 237                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 238                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 239                 echo '</ul>';
 240
 241                 echo '<h2>' . _MANAGE_SKINS . '</h2>';
 242                 echo '<ul>';
 243                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 244                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 245                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 246                 echo '</ul>';
 247
 248                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 249                 echo '<ul>';
 250                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 251                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 252                 echo '</ul>';
 253
 254                 $this->pagefoot();
 255         }
 256
 257         /**
 258          * @todo document this
 259          */
 260         function action_itemlist($blogid = '') {
 261                 global $member, $manager;
 262
 263                 if ($blogid == '')
 264                         $blogid = intRequestVar('blogid');
 265
 266                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 267
 268                 $this->pagehead();
 269                 $blog =& $manager->getBlog($blogid);
 270
 271                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 272                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 273
 274                 // start index
 275                 if (postVar('start'))
 276                         $start = intPostVar('start');
 277                 else
 278                         $start = 0;
 279
 280                 if ($start == 0)
 281                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 282
 283                 // amount of items to show
 284                 if (postVar('amount'))
 285                         $amount = intPostVar('amount');
 286                 else
 287                         $amount = 10;
 288
 289                 $search = postVar('search');    // search through items
 290
 291                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 292                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 293                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 294
 295                 if ($search)
 296                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 297
 298                 // non-blog-admins can only edit/delete their own items
 299                 if (!$member->blogAdminRights($blogid))
 300                         $query .= ' and iauthor=' . $member->getID();
 301
 302
 303                 $query .= ' ORDER BY itime DESC'
 304                                 . " LIMIT $start,$amount";
 305
 306                 $template['content'] = 'itemlist';
 307                 $template['now'] = $blog->getCorrectTime(time());
 308
 309                 $manager->loadClass("ENCAPSULATE");
 310                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 311                 $navList->showBatchList('item',$query,'table',$template);
 312
 313
 314                 $this->pagefoot();
 315         }
 316
 317         /**
 318          * @todo document this
 319          */
 320         function action_batchitem() {
 321                 global $member, $manager;
 322
 323                 // check if logged in
 324                 $member->isLoggedIn() or $this->disallow();
 325
 326                 // more precise check will be done for each performed operation
 327
 328                 // get array of itemids from request
 329                 $selected = requestIntArray('batch');
 330                 $action = requestVar('batchaction');
 331
 332                 // Show error when no items were selected
 333                 if (!is_array($selected) || sizeof($selected) == 0)
 334                         $this->error(_BATCH_NOSELECTION);
 335
 336                 // On move: when no destination blog/category chosen, show choice now
 337                 $destCatid = intRequestVar('destcatid');
 338                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 339                         $this->batchMoveSelectDestination('item',$selected);
 340
 341                 // On delete: check if confirmation has been given
 342                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 343                         $this->batchAskDeleteConfirmation('item',$selected);
 344
 345                 $this->pagehead();
 346
 347                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 348                 echo '<h2>',_BATCH_ITEMS,'</h2>';
 349                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 350                 echo '<ul>';
 351
 352
 353                 // walk over all itemids and perform action
 354                 foreach ($selected as $itemid) {
 355                         $itemid = intval($itemid);
 356                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 357
 358                         // perform action, display errors if needed
 359                         switch($action) {
 360                                 case 'delete':
 361                                         $error = $this->deleteOneItem($itemid);
 362                                         break;
 363                                 case 'move':
 364                                         $error = $this->moveOneItem($itemid, $destCatid);
 365                                         break;
 366                                 default:
 367                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 368                         }
 369
 370                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 371                         echo '</li>';
 372                 }
 373
 374                 echo '</ul>';
 375                 echo '<b>',_BATCH_DONE,'</b>';
 376
 377                 $this->pagefoot();
 378
 379
 380         }
 381
 382         /**
 383          * @todo document this
 384          */
 385         function action_batchcomment() {
 386                 global $member;
 387
 388                 // check if logged in
 389                 $member->isLoggedIn() or $this->disallow();
 390
 391                 // more precise check will be done for each performed operation
 392
 393                 // get array of itemids from request
 394                 $selected = requestIntArray('batch');
 395                 $action = requestVar('batchaction');
 396
 397                 // Show error when no items were selected
 398                 if (!is_array($selected) || sizeof($selected) == 0)
 399                         $this->error(_BATCH_NOSELECTION);
 400
 401                 // On delete: check if confirmation has been given
 402                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 403                         $this->batchAskDeleteConfirmation('comment',$selected);
 404
 405                 $this->pagehead();
 406
 407                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 408                 echo '<h2>',_BATCH_COMMENTS,'</h2>';
 409                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 410                 echo '<ul>';
 411
 412                 // walk over all itemids and perform action
 413                 foreach ($selected as $commentid) {
 414                         $commentid = intval($commentid);
 415                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 416
 417                         // perform action, display errors if needed
 418                         switch($action) {
 419                                 case 'delete':
 420                                         $error = $this->deleteOneComment($commentid);
 421                                         break;
 422                                 default:
 423                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 424                         }
 425
 426                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 427                         echo '</li>';
 428                 }
 429
 430                 echo '</ul>';
 431                 echo '<b>',_BATCH_DONE,'</b>';
 432
 433                 $this->pagefoot();
 434
 435
 436         }
 437
 438         /**
 439          * @todo document this
 440          */
 441         function action_batchmember() {
 442                 global $member;
 443
 444                 // check if logged in and admin
 445                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 446
 447                 // get array of itemids from request
 448                 $selected = requestIntArray('batch');
 449                 $action = requestVar('batchaction');
 450
 451                 // Show error when no members selected
 452                 if (!is_array($selected) || sizeof($selected) == 0)
 453                         $this->error(_BATCH_NOSELECTION);
 454
 455                 // On delete: check if confirmation has been given
 456                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 457                         $this->batchAskDeleteConfirmation('member',$selected);
 458
 459                 $this->pagehead();
 460
 461                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 462                 echo '<h2>',_BATCH_MEMBERS,'</h2>';
 463                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 464                 echo '<ul>';
 465
 466                 // walk over all itemids and perform action
 467                 foreach ($selected as $memberid) {
 468                         $memberid = intval($memberid);
 469                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 470
 471                         // perform action, display errors if needed
 472                         switch($action) {
 473                                 case 'delete':
 474                                         $error = $this->deleteOneMember($memberid);
 475                                         break;
 476                                 case 'setadmin':
 477                                         // always succeeds
 478                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 479                                         $error = '';
 480                                         break;
 481                                 case 'unsetadmin':
 482                                         // there should always remain at least one super-admin
 483                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 484                                         if (mysql_num_rows($r) < 2)
 485                                                 $error = _ERROR_ATLEASTONEADMIN;
 486                                         else
 487                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 488                                         break;
 489                                 default:
 490                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 491                         }
 492
 493                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 494                         echo '</li>';
 495                 }
 496
 497                 echo '</ul>';
 498                 echo '<b>',_BATCH_DONE,'</b>';
 499
 500                 $this->pagefoot();
 501
 502
 503         }
 504
 505         /**
 506          * @todo document this
 507          */
 508         function action_batchteam() {
 509                 global $member;
 510
 511                 $blogid = intRequestVar('blogid');
 512
 513                 // check if logged in and admin
 514                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 515
 516                 // get array of itemids from request
 517                 $selected = requestIntArray('batch');
 518                 $action = requestVar('batchaction');
 519
 520                 // Show error when no members selected
 521                 if (!is_array($selected) || sizeof($selected) == 0)
 522                         $this->error(_BATCH_NOSELECTION);
 523
 524                 // On delete: check if confirmation has been given
 525                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 526                         $this->batchAskDeleteConfirmation('team',$selected);
 527
 528                 $this->pagehead();
 529
 530                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 531
 532                 echo '<h2>',_BATCH_TEAM,'</h2>';
 533                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 534                 echo '<ul>';
 535
 536                 // walk over all itemids and perform action
 537                 foreach ($selected as $memberid) {
 538                         $memberid = intval($memberid);
 539                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 540
 541                         // perform action, display errors if needed
 542                         switch($action) {
 543                                 case 'delete':
 544                                         $error = $this->deleteOneTeamMember($blogid, $memberid);
 545                                         break;
 546                                 case 'setadmin':
 547                                         // always succeeds
 548                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 549                                         $error = '';
 550                                         break;
 551                                 case 'unsetadmin':
 552                                         // there should always remain at least one admin
 553                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 554                                         if (mysql_num_rows($r) < 2)
 555                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;
 556                                         else
 557                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 558                                         break;
 559                                 default:
 560                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 561                         }
 562
 563                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 564                         echo '</li>';
 565                 }
 566
 567                 echo '</ul>';
 568                 echo '<b>',_BATCH_DONE,'</b>';
 569
 570                 $this->pagefoot();
 571
 572
 573         }
 574
 575         /**
 576          * @todo document this
 577          */
 578         function action_batchcategory() {
 579                 global $member, $manager;
 580
 581                 // check if logged in
 582                 $member->isLoggedIn() or $this->disallow();
 583
 584                 // more precise check will be done for each performed operation
 585
 586                 // get array of itemids from request
 587                 $selected = requestIntArray('batch');
 588                 $action = requestVar('batchaction');
 589
 590                 // Show error when no items were selected
 591                 if (!is_array($selected) || sizeof($selected) == 0)
 592                         $this->error(_BATCH_NOSELECTION);
 593
 594                 // On move: when no destination blog chosen, show choice now
 595                 $destBlogId = intRequestVar('destblogid');
 596                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 597                         $this->batchMoveCategorySelectDestination('category',$selected);
 598
 599                 // On delete: check if confirmation has been given
 600                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 601                         $this->batchAskDeleteConfirmation('category',$selected);
 602
 603                 $this->pagehead();
 604
 605                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 606                 echo '<h2>',BATCH_CATEGORIES,'</h2>';
 607                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 608                 echo '<ul>';
 609
 610                 // walk over all itemids and perform action
 611                 foreach ($selected as $catid) {
 612                         $catid = intval($catid);
 613                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 614
 615                         // perform action, display errors if needed
 616                         switch($action) {
 617                                 case 'delete':
 618                                         $error = $this->deleteOneCategory($catid);
 619                                         break;
 620                                 case 'move':
 621                                         $error = $this->moveOneCategory($catid, $destBlogId);
 622                                         break;
 623                                 default:
 624                                         $error = _BATCH_UNKNOWN . htmlspecialchars($action);
 625                         }
 626
 627                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';
 628                         echo '</li>';
 629                 }
 630
 631                 echo '</ul>';
 632                 echo '<b>',_BATCH_DONE,'</b>';
 633
 634                 $this->pagefoot();
 635
 636         }
 637
 638         /**
 639          * @todo document this
 640          */
 641         function batchMoveSelectDestination($type, $ids) {
 642                 global $manager;
 643                 $this->pagehead();
 644                 ?>
 645                 <h2><?php echo _MOVE_TITLE?></h2>
 646                 <form method="post" action="index.php"><div>
 647
 648                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 649                         <input type="hidden" name="batchaction" value="move" />
 650                         <?php
 651                                 $manager->addTicketHidden();
 652
 653                                 // insert selected item numbers
 654                                 $idx = 0;
 655                                 foreach ($ids as $id)
 656                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 657
 658                                 // show blog/category selection list
 659                                 $this->selectBlogCategory('destcatid');
 660
 661                         ?>
 662
 663
 664                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 665
 666                 </div></form>
 667                 <?php           $this->pagefoot();
 668                 exit;
 669         }
 670
 671         /**
 672          * @todo document this
 673          */
 674         function batchMoveCategorySelectDestination($type, $ids) {
 675                 global $manager;
 676                 $this->pagehead();
 677                 ?>
 678                 <h2><?php echo _MOVECAT_TITLE?></h2>
 679                 <form method="post" action="index.php"><div>
 680
 681                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 682                         <input type="hidden" name="batchaction" value="move" />
 683                         <?php
 684                                 $manager->addTicketHidden();
 685
 686                                 // insert selected item numbers
 687                                 $idx = 0;
 688                                 foreach ($ids as $id)
 689                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 690
 691                                 // show blog/category selection list
 692                                 $this->selectBlog('destblogid');
 693
 694                         ?>
 695
 696
 697                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 698
 699                 </div></form>
 700                 <?php           $this->pagefoot();
 701                 exit;
 702         }
 703
 704         /**
 705          * @todo document this
 706          */
 707         function batchAskDeleteConfirmation($type, $ids) {
 708                 global $manager;
 709
 710                 $this->pagehead();
 711                 ?>
 712                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 713                 <form method="post" action="index.php"><div>
 714
 715                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 716                         <?php $manager->addTicketHidden() ?>
 717                         <input type="hidden" name="batchaction" value="delete" />
 718                         <input type="hidden" name="confirmation" value="yes" />
 719                         <?php                           // insert selected item numbers
 720                                 $idx = 0;
 721                                 foreach ($ids as $id)
 722                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 723
 724                                 // add hidden vars for team & comment
 725                                 if ($type == 'team')
 726                                 {
 727                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 728                                 }
 729                                 if ($type == 'comment')
 730                                 {
 731                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 732                                 }
 733
 734                         ?>
 735
 736                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 737
 738                 </div></form>
 739                 <?php           $this->pagefoot();
 740                 exit;
 741         }
 742
 743
 744         /**
 745          * Inserts a HTML select element with choices for all categories to which the current
 746          * member has access
 747          * @see function selectBlog
 748          */
 749         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 750                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 751         }
 752
 753         /**
 754          * Inserts a HTML select element with choices for all blogs to which the user has access
 755          *              mode = 'blog' => shows blognames and values are blogids
 756          *              mode = 'category' => show category names and values are catids
 757          *
 758          * @param $iForcedBlogInclude
 759          *              ID of a blog that always needs to be included, without checking if the
 760          *              member is on the blog team (-1 = none)
 761          * @todo document parameters
 762          */
 763         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 764                 global $member, $CONF;
 765
 766                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 767                 $aBlogIds = array();
 768                 if ($iForcedBlogInclude != -1)
 769                         $aBlogIds[] = intval($iForcedBlogInclude);
 770
 771                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 772                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 773                 else
 774                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 775                 $rblogids = sql_query($queryBlogs);
 776                 while ($o = mysql_fetch_object($rblogids))
 777                         if ($o->bnumber != $iForcedBlogInclude)
 778                                 $aBlogIds[] = intval($o->bnumber);
 779
 780                 if (count($aBlogIds) == 0)
 781                         return;
 782
 783                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 784
 785                 // 1. select blogs (we'll create optiongroups)
 786                 // (only select those blogs that have the user on the team)
 787                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 788                 $blogs = sql_query($queryBlogs);
 789                 if ($mode == 'category') {
 790                         if (mysql_num_rows($blogs) > 1)
 791                                 $multipleBlogs = 1;
 792
 793                         while ($oBlog = mysql_fetch_object($blogs)) {
 794                                 if ($multipleBlogs)
 795                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';
 796
 797                                 // show selection to create new category when allowed/wanted
 798                                 if ($showNewCat) {
 799                                         // check if allowed to do so
 800                                         if ($member->blogAdminRights($oBlog->bnumber))
 801                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 802                                 }
 803
 804                                 // 2. for each category in that blog
 805                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 806                                 while ($oCat = mysql_fetch_object($categories)) {
 807                                         if ($oCat->catid == $selected)
 808                                                 $selectText = ' selected="selected" ';
 809                                         else
 810                                                 $selectText = '';
 811                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';
 812                                 }
 813
 814                                 if ($multipleBlogs)
 815                                         echo '</optgroup>';
 816                         }
 817                 } else {
 818                         // blog mode
 819                         while ($oBlog = mysql_fetch_object($blogs)) {
 820                                 echo '<option value="',$oBlog->bnumber,'"';
 821                                 if ($oBlog->bnumber == $selected)
 822                                         echo ' selected="selected"';
 823                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';
 824                         }
 825                 }
 826                 echo '</select>';
 827
 828         }
 829
 830         /**
 831          * @todo document this
 832          */
 833         function action_browseownitems() {
 834                 global $member, $manager;
 835
 836                 $this->pagehead();
 837
 838                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 839                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 840
 841                 // start index
 842                 if (postVar('start'))
 843                         $start = intPostVar('start');
 844                 else
 845                         $start = 0;
 846
 847                 // amount of items to show
 848                 if (postVar('amount'))
 849                         $amount = intPostVar('amount');
 850                 else
 851                         $amount = 10;
 852
 853                 $search = postVar('search');    // search through items
 854
 855                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 856                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 857                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 858
 859                 if ($search)
 860                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 861
 862                 $query .= ' ORDER BY itime DESC'
 863                                 . " LIMIT $start,$amount";
 864
 865                 $template['content'] = 'itemlist';
 866                 $template['now'] = time();
 867
 868                 $manager->loadClass("ENCAPSULATE");
 869                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 870                 $navList->showBatchList('item',$query,'table',$template);
 871
 872                 $this->pagefoot();
 873
 874         }
 875
 876         /**
 877          * Show all the comments for a given item
 878          * @param int $itemid
 879          */
 880         function action_itemcommentlist($itemid = '') {
 881                 global $member, $manager;
 882
 883                 if ($itemid == '')
 884                         $itemid = intRequestVar('itemid');
 885
 886                 // only allow if user is allowed to alter item
 887                 $member->canAlterItem($itemid) or $this->disallow();
 888
 889                 // ED$ what is this??? getBlogIDFromItemId()??
 890                 $blogid = getBlogIdFromItemId($itemid);
 891
 892                 $this->pagehead();
 893
 894                 // start index
 895                 if (postVar('start'))
 896                         $start = intPostVar('start');
 897                 else
 898                         $start = 0;
 899
 900                 // amount of items to show
 901                 if (postVar('amount'))
 902                         $amount = intPostVar('amount');
 903                 else
 904                         $amount = 10;
 905
 906                 $search = postVar('search');
 907
 908                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 909                 echo '<h2>',_COMMENTS,'</h2>';
 910
 911                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE citem=' . $itemid;
 912
 913                 if ($search)
 914                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 915
 916                 $query .= ' ORDER BY ctime ASC'
 917                                 . " LIMIT $start,$amount";
 918
 919                 $template['content'] = 'commentlist';
 920                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
 921
 922                 $manager->loadClass("ENCAPSULATE");
 923                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
 924                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
 925
 926                 $this->pagefoot();
 927         }
 928
 929         /**
 930          * Browse own comments
 931          */
 932         function action_browseowncomments() {
 933                 global $member, $manager;
 934
 935                 // start index
 936                 if (postVar('start'))
 937                         $start = intPostVar('start');
 938                 else
 939                         $start = 0;
 940
 941                 // amount of items to show
 942                 if (postVar('amount'))
 943                         $amount = intPostVar('amount');
 944                 else
 945                         $amount = 10;
 946
 947                 $search = postVar('search');
 948
 949
 950                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 951
 952                 if ($search)
 953                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 954
 955                 $query .= ' ORDER BY ctime DESC'
 956                                 . " LIMIT $start,$amount";
 957
 958                 $this->pagehead();
 959
 960                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 961                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';
 962
 963                 $template['content'] = 'commentlist';
 964                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself
 965
 966                 $manager->loadClass("ENCAPSULATE");
 967                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
 968                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
 969
 970                 $this->pagefoot();
 971         }
 972
 973         /**
 974          * Browse all comments for a weblog
 975          * @param int $blogid
 976          */
 977         function action_blogcommentlist($blogid = '')
 978         {
 979                 global $member, $manager;
 980
 981                 if ($blogid == '')
 982                         $blogid = intRequestVar('blogid');
 983                 else
 984                         $blogid = intval($blogid);
 985
 986                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 987
 988                 // start index
 989                 if (postVar('start'))
 990                         $start = intPostVar('start');
 991                 else
 992                         $start = 0;
 993
 994                 // amount of items to show
 995                 if (postVar('amount'))
 996                         $amount = intPostVar('amount');
 997                 else
 998                         $amount = 10;
 999
1000                 $search = postVar('search');            // search through comments
1001
1002
1003                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1004
1005                 if ($search != '')
1006                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
1007
1008
1009                 $query .= ' ORDER BY ctime DESC'
1010                                 . " LIMIT $start,$amount";
1011
1012
1013                 $blog =& $manager->getBlog($blogid);
1014
1015                 $this->pagehead();
1016
1017                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1018                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1019
1020                 $template['content'] = 'commentlist';
1021                 $template['canAddBan'] = $member->blogAdminRights($blogid);
1022
1023                 $manager->loadClass("ENCAPSULATE");
1024                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1025                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1026
1027                 $this->pagefoot();
1028         }
1029
1030         /**
1031          * Provide a page to item a new item to the given blog
1032          */
1033         function action_createitem() {
1034                 global $member, $manager;
1035
1036                 $blogid = intRequestVar('blogid');
1037
1038                 // check if allowed
1039                 $member->teamRights($blogid) or $this->disallow();
1040
1041                 $memberid = $member->getID();
1042
1043                 $blog =& $manager->getBlog($blogid);
1044
1045                 $this->pagehead();
1046
1047                 // generate the add-item form
1048                 $formfactory =& new PAGEFACTORY($blogid);
1049                 $formfactory->createAddForm('admin');
1050
1051                 $this->pagefoot();
1052         }
1053
1054         /**
1055          * @todo document this
1056          */
1057         function action_itemedit() {
1058                 global $member, $manager;
1059
1060                 $itemid = intRequestVar('itemid');
1061
1062                 // only allow if user is allowed to alter item
1063                 $member->canAlterItem($itemid) or $this->disallow();
1064
1065                 $item =& $manager->getItem($itemid,1,1);
1066                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1067
1068                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1069
1070                 if ($blog->convertBreaks()) {
1071                         $item['body'] = removeBreaks($item['body']);
1072                         $item['more'] = removeBreaks($item['more']);
1073                 }
1074
1075                 // form to edit blog items
1076                 $this->pagehead();
1077                 $formfactory =& new PAGEFACTORY($blog->getID());
1078                 $formfactory->createEditForm('admin',$item);
1079                 $this->pagefoot();
1080         }
1081
1082         /**
1083          * @todo document this
1084          */
1085         function action_itemupdate() {
1086                 global $member, $manager, $CONF;
1087
1088                 $itemid = intRequestVar('itemid');
1089                 $catid = postVar('catid');
1090
1091                 // only allow if user is allowed to alter item
1092                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1093
1094                 $actiontype = postVar('actiontype');
1095
1096                 // delete actions are handled by itemdelete (which has confirmation)
1097                 if ($actiontype == 'delete') {
1098                         $this->action_itemdelete();
1099                         return;
1100                 }
1101
1102                 $body   = postVar('body');
1103                 $title  = postVar('title');
1104                 $more   = postVar('more');
1105                 $closed = intPostVar('closed');
1106                 $draftid = intPostVar('draftid');
1107
1108                 // default action = add now
1109                 if (!$actiontype)
1110                         $actiontype='addnow';
1111
1112                 // create new category if needed
1113                 if (strstr($catid,'newcat')) {
1114                         // get blogid
1115                         list($blogid) = sscanf($catid,"newcat-%d");
1116
1117                         // create
1118                         $blog =& $manager->getBlog($blogid);
1119                         $catid = $blog->createNewCategory();
1120
1121                         // show error when sth goes wrong
1122                         if (!$catid)
1123                                 $this->doError(_ERROR_CATCREATEFAIL);
1124                 }
1125
1126                 /*
1127                         set some variables based on actiontype
1128
1129                         actiontypes:
1130                                 draft items -> addnow, addfuture, adddraft, delete
1131                                 non-draft items -> edit, changedate, delete
1132
1133                         variables set:
1134                                 $timestamp: set to a nonzero value for future dates or date changes
1135                                 $wasdraft: set to 1 when the item used to be a draft item
1136                                 $publish: set to 1 when the edited item is not a draft
1137                 */
1138                 switch ($actiontype) {
1139                         case 'adddraft':
1140                                 $publish = 0;
1141                                 $wasdraft = 1;
1142                                 $timestamp = 0;
1143                                 break;
1144                         case 'addfuture':
1145                                 $wasdraft = 1;
1146                                 $publish = 1;
1147                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1148                                 break;
1149                         case 'addnow':
1150                                 $wasdraft = 1;
1151                                 $publish = 1;
1152                                 $timestamp = 0;
1153                                 break;
1154                         case 'changedate':
1155                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1156                                 $publish = 1;
1157                                 $wasdraft = 0;
1158                                 break;
1159                         case 'edit':
1160                         default:
1161                                 $publish = 1;
1162                                 $wasdraft = 0;
1163                                 $timestamp = 0;
1164                 }
1165
1166                 // edit the item for real
1167                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1168
1169                 $blogid = getBlogIDFromItemID($itemid);
1170                 $blog =& $manager->getBlog($blogid);
1171
1172                 $isFuture = 0;
1173                 if ($timestamp > $blog->getCorrectTime(time())) {
1174                         $isFuture = 1;
1175                 }
1176
1177                 $this->updateFuturePosted($blogid);
1178
1179                 if ($draftid > 0) {
1180                         ITEM::delete($draftid);
1181                 }
1182
1183                 if (!$closed && $publish && $wasdraft && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 && !$isFuture) {
1184                         $this->action_sendping($blogid);
1185                         return;
1186                 }
1187
1188                 // show category edit window when we created a new category
1189                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1190                 if ($catid != intPostVar('catid')) {
1191                         $this->action_categoryedit(
1192                                 $catid,
1193                                 $blog->getID(),
1194                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1195                         );
1196                 } else {
1197                         // TODO: set start item correctly for itemlist
1198                         $this->action_itemlist(getBlogIDFromItemID($itemid));
1199                 }
1200         }
1201
1202         /**
1203          * @todo document this
1204          */
1205         function action_itemdelete() {
1206                 global $member, $manager;
1207
1208                 $itemid = intRequestVar('itemid');
1209
1210                 // only allow if user is allowed to alter item
1211                 $member->canAlterItem($itemid) or $this->disallow();
1212
1213                 if (!$manager->existsItem($itemid,1,1))
1214                         $this->error(_ERROR_NOSUCHITEM);
1215
1216                 $item =& $manager->getItem($itemid,1,1);
1217                 $title = htmlspecialchars(strip_tags($item['title']));
1218                 $body = strip_tags($item['body']);
1219                 $body = htmlspecialchars(shorten($body,300,'...'));
1220
1221                 $this->pagehead();
1222                 ?>
1223                         <h2><?php echo _DELETE_CONFIRM?></h2>
1224
1225                         <p><?php echo _CONFIRMTXT_ITEM?></p>
1226
1227                         <div class="note">
1228                                 <b>"<?php echo  $title ?>"</b>
1229                                 <br />
1230                                 <?php echo $body?>
1231                         </div>
1232
1233                         <form method="post" action="index.php"><div>
1234                                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1235                                 <?php $manager->addTicketHidden() ?>
1236                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1237                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1238                         </div></form>
1239                 <?php
1240                 $this->pagefoot();
1241         }
1242
1243         /**
1244          * @todo document this
1245          */
1246         function action_itemdeleteconfirm() {
1247                 global $member;
1248
1249                 $itemid = intRequestVar('itemid');
1250
1251                 // only allow if user is allowed to alter item
1252                 $member->canAlterItem($itemid) or $this->disallow();
1253
1254                 // get blogid first ED$ What is this? getBlogIDFromItemId()???
1255                 $blogid = getBlogIdFromItemId($itemid);
1256
1257                 // delete item (note: some checks will be performed twice)
1258                 $this->deleteOneItem($itemid);
1259
1260                 $this->action_itemlist($blogid);
1261         }
1262
1263         /**
1264          * Deletes one item and returns error if something goes wrong
1265          * @param int $itemid
1266          */
1267         function deleteOneItem($itemid) {
1268                 global $member, $manager;
1269
1270                 // only allow if user is allowed to alter item (also checks if itemid exists)
1271                 if (!$member->canAlterItem($itemid))
1272                         return _ERROR_DISALLOWED;
1273
1274                 // need to get blogid before the item is deleted
1275                 $blogid = getBlogIDFromItemId($itemid);
1276
1277                 $manager->loadClass('ITEM');
1278                 ITEM::delete($itemid);
1279
1280                 // update blog's futureposted
1281                 $this->updateFuturePosted($blogid);
1282         }
1283
1284         /**
1285          * Update a blog's future posted flag
1286          * @param int $blogid
1287          */
1288         function updateFuturePosted($blogid) {
1289                 global $manager;
1290
1291                 $blog =& $manager->getBlog($blogid);
1292                 $currenttime = $blog->getCorrectTime(time());
1293                 $result = sql_query("SELECT * FROM ".sql_table('item').
1294                         " WHERE iblog='".$blogid."' AND iposted=0 AND itime>".mysqldate($currenttime));
1295                 if (mysql_num_rows($result) > 0) {
1296                                 $blog->setFuturePost();
1297                 }
1298                 else {
1299                                 $blog->clearFuturePost();
1300                 }
1301         }
1302
1303         /**
1304          * @todo document this
1305          */
1306         function action_itemmove() {
1307                 global $member, $manager;
1308
1309                 $itemid = intRequestVar('itemid');
1310
1311                 // only allow if user is allowed to alter item
1312                 $member->canAlterItem($itemid) or $this->disallow();
1313
1314                 $item =& $manager->getItem($itemid,1,1);
1315
1316                 $this->pagehead();
1317                 ?>
1318                         <h2><?php echo _MOVE_TITLE?></h2>
1319                         <form method="post" action="index.php"><div>
1320                                 <input type="hidden" name="action" value="itemmoveto" />
1321                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1322
1323                                 <?php
1324
1325                                         $manager->addTicketHidden();
1326                                         $this->selectBlogCategory('catid',$item['catid'],10,1);
1327                                 ?>
1328
1329                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1330                         </div></form>
1331                 <?php
1332                 $this->pagefoot();
1333         }
1334
1335         /**
1336          * @todo document this
1337          */
1338         function action_itemmoveto() {
1339                 global $member, $manager;
1340
1341                 $itemid = intRequestVar('itemid');
1342                 $catid = requestVar('catid');
1343
1344                 // create new category if needed
1345                 if (strstr($catid,'newcat')) {
1346                         // get blogid
1347                         list($blogid) = sscanf($catid,'newcat-%d');
1348
1349                         // create
1350                         $blog =& $manager->getBlog($blogid);
1351                         $catid = $blog->createNewCategory();
1352
1353                         // show error when sth goes wrong
1354                         if (!$catid)
1355                                 $this->doError(_ERROR_CATCREATEFAIL);
1356                 }
1357
1358                 // only allow if user is allowed to alter item
1359                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1360
1361                 $old_blogid = getBlogIDFromItemId($itemid);
1362
1363                 ITEM::move($itemid, $catid);
1364
1365                 // set the futurePosted flag on the blog
1366                 $this->updateFuturePosted(getBlogIDFromItemId($itemid));
1367
1368                 // reset the futurePosted in case the item is moved from one blog to another
1369                 $this->updateFuturePosted($old_blogid);
1370
1371                 if ($catid != intRequestVar('catid'))
1372                         $this->action_categoryedit($catid, $blog->getID());
1373                 else
1374                         $this->action_itemlist(getBlogIDFromCatID($catid));
1375         }
1376
1377         /**
1378          * Moves one item to a given category (category existance should be checked by caller)
1379          * errors are returned
1380          * @param int $itemid
1381          * @param int $destCatid category ID to which the item will be moved
1382          */
1383         function moveOneItem($itemid, $destCatid) {
1384                 global $member;
1385
1386                 // only allow if user is allowed to move item
1387                 if (!$member->canUpdateItem($itemid, $destCatid))
1388                         return _ERROR_DISALLOWED;
1389
1390                 ITEM::move($itemid, $destCatid);
1391         }
1392
1393         /**
1394          * Adds a item to the chosen blog
1395          */
1396         function action_additem() {
1397                 global $member, $manager, $CONF;
1398
1399                 $manager->loadClass('ITEM');
1400
1401                 $result = ITEM::createFromRequest();
1402
1403                 if ($result['status'] == 'error')
1404                         $this->error($result['message']);
1405
1406                 $blogid = getBlogIDFromItemID($result['itemid']);
1407                 $blog =& $manager->getBlog($blogid);
1408
1409                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));
1410
1411                 if ($result['status'] == 'newcategory')
1412                         $this->action_categoryedit(
1413                                 $result['catid'],
1414                                 $blogid,
1415                                 $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0 ? $pingUrl : ''
1416                         );
1417                 elseif ((postVar('actiontype') == 'addnow') && $blog->sendPing() && numberOfEventSubscriber('SendPing') > 0)
1418                         $this->action_sendping($blogid);
1419                 else
1420                         $this->action_itemlist($blogid);
1421         }
1422
1423         /**
1424          * Shows a window that says we're about to ping.
1425          * immediately refresh to the real pinging page, which will
1426          * show an error, or redirect to the blog.
1427          *
1428          * @param int $blogid ID of blog for which ping needs to be sent out
1429          */
1430         function action_sendping($blogid = -1) {
1431                 global $member, $manager;
1432
1433                 if ($blogid == -1)
1434                         $blogid = intRequestVar('blogid');
1435
1436                 $member->isLoggedIn() or $this->disallow();
1437
1438                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));
1439
1440                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');
1441                 ?>
1442                 <h2>Site Updated, Now pinging various weblog listing services...</h2>
1443
1444                 <p>
1445                         This can take a while...
1446                 </p>
1447
1448                 <p>
1449                         If you aren't automatically passed through, <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>">try again</a>
1450                 </p>
1451                 <?php           $this->pagefoot();
1452         }
1453
1454         /**
1455          * Sends the real ping (can take up to 10 seconds!)
1456          */
1457         function action_rawping() {
1458                 global $manager;
1459                 // TODO: checks?
1460
1461                 $blogid = intRequestVar('blogid');
1462                 $blog =& $manager->getBlog($blogid);
1463
1464                 $this->pagehead();
1465
1466                 ?>
1467
1468                 <h2>Pinging services, please wait...</h2>
1469                 <div class='note'>
1470                 <?
1471
1472                 // send sendPing event
1473                 $manager->notify('SendPing', array('blogid' => $blogid));
1474
1475                 ?>
1476                 </div>
1477
1478                 <ul>
1479                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>">View list of recent items for <?php echo htmlspecialchars($blog->getName())?></a></li>
1480                         <li><a href="<?php echo $blog->getURL()?>">Visit your own site</a></li>
1481                 </ul>
1482
1483                 <?php           $this->pagefoot();
1484         }
1485
1486         /**
1487          * Allows to edit previously made comments
1488          */
1489         function action_commentedit() {
1490                 global $member, $manager;
1491
1492                 $commentid = intRequestVar('commentid');
1493
1494                 $member->canAlterComment($commentid) or $this->disallow();
1495
1496                 $comment = COMMENT::getComment($commentid);
1497
1498                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
1499
1500                 // change <br /> to \n
1501                 $comment['body'] = str_replace('<br />','',$comment['body']);
1502
1503                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
1504
1505                 $this->pagehead();
1506
1507                 ?>
1508                 <h2><?php echo _EDITC_TITLE?></h2>
1509
1510                 <form action="index.php" method="post"><div>
1511
1512                 <input type="hidden" name="action" value="commentupdate" />
1513                 <?php $manager->addTicketHidden(); ?>
1514                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1515                 <table><tr>
1516                         <th colspan="2"><?php echo _EDITC_TITLE?></th>
1517                 </tr><tr>
1518                         <td><?php echo _EDITC_WHO?></td>
1519                         <td>
1520                         <?php                           if ($comment['member'])
1521                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1522                                 else
1523                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1524                         ?>
1525                         </td>
1526                 </tr><tr>
1527                         <td><?php echo _EDITC_WHEN?></td>
1528                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1529                 </tr><tr>
1530                         <td><?php echo _EDITC_HOST?></td>
1531                         <td><?php echo  $comment['host']; ?></td>
1532                 </tr><tr>
1533                         <td><?php echo _EDITC_TEXT?></td>
1534                         <td>
1535                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)
1536                                         echo $comment['body'];
1537                                 ?></textarea>
1538                         </td>
1539                 </tr><tr>
1540                         <td><?php echo _EDITC_EDIT?></td>
1541                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1542                 </tr></table>
1543
1544                 </div></form>
1545                 <?php
1546                 $this->pagefoot();
1547         }
1548
1549         /**
1550          * @todo document this
1551          */
1552         function action_commentupdate() {
1553                 global $member, $manager;
1554
1555                 $commentid = intRequestVar('commentid');
1556
1557                 $member->canAlterComment($commentid) or $this->disallow();
1558
1559                 $body = postVar('body');
1560
1561                 // intercept words that are too long
1562                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
1563                         $this->error(_ERROR_COMMENT_LONGWORD);
1564
1565                 // check length
1566                 if (strlen($body)<3)
1567                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1568                 if (strlen($body)>5000)
1569                         $this->error(_ERROR_COMMENT_TOOLONG);
1570
1571
1572                 // prepare body
1573                 $body = COMMENT::prepareBody($body);
1574
1575                 // call plugins
1576                 $manager->notify('PreUpdateComment',array('body' => &$body));
1577
1578                 $query =  'UPDATE '.sql_table('comment')
1579                            . " SET cbody='" .addslashes($body). "'"
1580                            . " WHERE cnumber=" . $commentid;
1581                 sql_query($query);
1582
1583                 // get itemid
1584                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1585                 $o = mysql_fetch_object($res);
1586                 $itemid = $o->citem;
1587
1588                 if ($member->canAlterItem($itemid))
1589                         $this->action_itemcommentlist($itemid);
1590                 else
1591                         $this->action_browseowncomments();
1592
1593         }
1594
1595         /**
1596          * @todo document this
1597          */
1598         function action_commentdelete() {
1599                 global $member, $manager;
1600
1601                 $commentid = intRequestVar('commentid');
1602
1603                 $member->canAlterComment($commentid) or $this->disallow();
1604
1605                 $comment = COMMENT::getComment($commentid);
1606
1607                 $body = strip_tags($comment['body']);
1608                 $body = htmlspecialchars(shorten($body, 300, '...'));
1609
1610                 if ($comment['member'])
1611                         $author = $comment['member'];
1612                 else
1613                         $author = $comment['user'];
1614
1615                 $this->pagehead();
1616                 ?>
1617
1618                         <h2><?php echo _DELETE_CONFIRM?></h2>
1619
1620                         <p><?php echo _CONFIRMTXT_COMMENT?></p>
1621
1622                         <div class="note">
1623                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1624                         <br />
1625                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1626                         </div>
1627
1628                         <form method="post" action="index.php"><div>
1629                                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1630                                 <?php $manager->addTicketHidden() ?>
1631                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1632                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1633                         </div></form>
1634                 <?php
1635                 $this->pagefoot();
1636         }
1637
1638         /**
1639          * @todo document this
1640          */
1641         function action_commentdeleteconfirm() {
1642                 global $member;
1643
1644                 $commentid = intRequestVar('commentid');
1645
1646                 // get item id first
1647                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1648                 $o = mysql_fetch_object($res);
1649                 $itemid = $o->citem;
1650
1651                 $error = $this->deleteOneComment($commentid);
1652                 if ($error)
1653                         $this->doError($error);
1654
1655                 if ($member->canAlterItem($itemid))
1656                         $this->action_itemcommentlist($itemid);
1657                 else
1658                         $this->action_browseowncomments();
1659         }
1660
1661         /**
1662          * @todo document this
1663          */
1664         function deleteOneComment($commentid) {
1665                 global $member, $manager;
1666
1667                 $commentid = intval($commentid);
1668
1669                 if (!$member->canAlterComment($commentid))
1670                         return _ERROR_DISALLOWED;
1671
1672                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1673
1674                 // delete the comments associated with the item
1675                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1676                 sql_query($query);
1677
1678                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1679
1680                 return '';
1681         }
1682
1683         /**
1684          * Usermanagement main
1685          */
1686         function action_usermanagement() {
1687                 global $member, $manager;
1688
1689                 // check if allowed
1690                 $member->isAdmin() or $this->disallow();
1691
1692                 $this->pagehead();
1693
1694                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1695
1696                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1697
1698                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1699
1700                 // show list of members with actions
1701                 $query =  'SELECT *'
1702                            . ' FROM '.sql_table('member');
1703                 $template['content'] = 'memberlist';
1704                 $template['tabindex'] = 10;
1705
1706                 $manager->loadClass("ENCAPSULATE");
1707                 $batch =& new BATCH('member');
1708                 $batch->showlist($query,'table',$template);
1709
1710                 echo '<h3>' . _MEMBERS_NEW .'</h3>';
1711                 ?>
1712                         <form method="post" action="index.php" name="memberedit"><div>
1713
1714                         <input type="hidden" name="action" value="memberadd" />
1715                         <?php $manager->addTicketHidden() ?>
1716
1717                         <table>
1718                         <tr>
1719                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1720                         </tr><tr>
1721                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1722                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1723                                 </td>
1724                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>
1725                         </tr><tr>
1726                                 <td><?php echo _MEMBERS_REALNAME?></td>
1727                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1728                         </tr><tr>
1729                                 <td><?php echo _MEMBERS_PWD?></td>
1730                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1731                         </tr><tr>
1732                                 <td><?php echo _MEMBERS_REPPWD?></td>
1733                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1734                         </tr><tr>
1735                                 <td><?php echo _MEMBERS_EMAIL?></td>
1736                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1737                         </tr><tr>
1738                                 <td><?php echo _MEMBERS_URL?></td>
1739                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1740                         </tr><tr>
1741                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1742                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1743                         </tr><tr>
1744                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1745                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1746                         </tr><tr>
1747                                 <td><?php echo _MEMBERS_NOTES?></td>
1748                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1749                         </tr><tr>
1750                                 <td><?php echo _MEMBERS_NEW?></td>
1751                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1752                         </tr></table>
1753
1754                         </div></form>
1755                 <?php
1756                 $this->pagefoot();
1757         }
1758
1759         /**
1760          * Edit member settings
1761          */
1762         function action_memberedit() {
1763                 $this->action_editmembersettings(intRequestVar('memberid'));
1764         }
1765
1766         /**
1767          * @todo document this
1768          */
1769         function action_editmembersettings($memberid = '') {
1770                 global $member, $manager, $CONF;
1771
1772                 if ($memberid == '')
1773                         $memberid = $member->getID();
1774
1775                 // check if allowed
1776                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1777
1778                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1779                 $this->pagehead($extrahead);
1780
1781                 // show message to go back to member overview (only for admins)
1782                 if ($member->isAdmin())
1783                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1784                 else
1785                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1786
1787                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1788
1789                 $mem = MEMBER::createFromID($memberid);
1790
1791                 ?>
1792                 <form method="post" action="index.php" name="memberedit"><div>
1793
1794                 <input type="hidden" name="action" value="changemembersettings" />
1795                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1796                 <?php $manager->addTicketHidden() ?>
1797
1798                 <table><tr>
1799                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1800                 </tr><tr>
1801                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1802                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1803                         </td>
1804                         <td>
1805                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1806                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />
1807                         <?php } else {
1808                                 echo htmlspecialchars($member->getDisplayName());
1809                            }
1810                         ?>
1811                         </td>
1812                 </tr><tr>
1813                         <td><?php echo _MEMBERS_REALNAME?></td>
1814                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>
1815                 </tr><tr>
1816                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1817                         <td><?php echo _MEMBERS_PWD?></td>
1818                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1819                 </tr><tr>
1820                         <td><?php echo _MEMBERS_REPPWD?></td>
1821                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1822                 <?php } ?>
1823                 </tr><tr>
1824                         <td><?php echo _MEMBERS_EMAIL?>
1825                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1826                         </td>
1827                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>
1828                 </tr><tr>
1829                         <td><?php echo _MEMBERS_URL?></td>
1830                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>
1831                 <?php // only allow to change this by super-admins
1832                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1833                    if ($member->isAdmin()) {
1834                 ?>
1835                         </tr><tr>
1836                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1837                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1838                         </tr><tr>
1839                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1840                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70,1,0,_YES,_NO,$mem->isAdmin()); ?></td>
1841                 <?php } ?>
1842                 </tr><tr>
1843                         <td><?php echo _MEMBERS_NOTES?></td>
1844                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>
1845                 </tr><tr>
1846                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1847                         </td>
1848                         <td>
1849
1850                                 <select name="deflang" tabindex="85">
1851                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>
1852                                 <?php                           // show a dropdown list of all available languages
1853                                 global $DIR_LANG;
1854                                 $dirhandle = opendir($DIR_LANG);
1855                                 while ($filename = readdir($dirhandle)) {
1856                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
1857                                                 $name = $matches[1];
1858                                                 echo "<option value='$name'";
1859                                                 if ($name == $mem->getLanguage())
1860                                                         echo " selected='selected'";
1861                                                 echo ">$name</option>";
1862                                         }
1863                                 }
1864                                 closedir($dirhandle);
1865
1866                                 ?>
1867                                 </select>
1868
1869                         </td>
1870                 </tr>
1871                 <?php
1872                         // plugin options
1873                         $this->_insertPluginOptions('member',$memberid);
1874                 ?>
1875                 <tr>
1876                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1877                 </tr><tr>
1878                         <td><?php echo _MEMBERS_EDIT?></td>
1879                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1880                 </tr></table>
1881
1882                 </div></form>
1883
1884                 <?php
1885                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1886
1887                         $manager->notify(
1888                                 'MemberSettingsFormExtras',
1889                                 array(
1890                                         'member' => &$mem
1891                                 )
1892                         );
1893
1894                 $this->pagefoot();
1895         }
1896
1897         /**
1898          * @todo document this
1899          */
1900         function action_changemembersettings() {
1901                 global $member, $CONF, $manager;
1902
1903                 $memberid = intRequestVar('memberid');
1904
1905                 // check if allowed
1906                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1907
1908                 $name                   = trim(strip_tags(postVar('name')));
1909                 $realname               = trim(strip_tags(postVar('realname')));
1910                 $password               = postVar('password');
1911                 $repeatpassword = postVar('repeatpassword');
1912                 $email                  = strip_tags(postVar('email'));
1913                 $url                    = strip_tags(postVar('url'));
1914
1915                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
1916                 if (!eregi("^https?://", $url))
1917                         $url = "http://".$url;
1918
1919                 $admin                  = postVar('admin');
1920                 $canlogin               = postVar('canlogin');
1921                 $notes                  = strip_tags(postVar('notes'));
1922                 $deflang                = postVar('deflang');
1923
1924                 $mem = MEMBER::createFromID($memberid);
1925
1926                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1927
1928                         if (!isValidDisplayName($name))
1929                                 $this->error(_ERROR_BADNAME);
1930
1931                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1932                                 $this->error(_ERROR_NICKNAMEINUSE);
1933
1934                         if ($password != $repeatpassword)
1935                                 $this->error(_ERROR_PASSWORDMISMATCH);
1936
1937                         if ($password && (strlen($password) < 6))
1938                                 $this->error(_ERROR_PASSWORDTOOSHORT);
1939                 }
1940
1941                 if (!isValidMailAddress($email))
1942                         $this->error(_ERROR_BADMAILADDRESS);
1943
1944
1945                 if (!$realname)
1946                         $this->error(_ERROR_REALNAMEMISSING);
1947
1948                 if (($deflang != '') && (!checkLanguage($deflang)))
1949                         $this->error(_ERROR_NOSUCHLANGUAGE);
1950
1951                 // check if there will remain at least one site member with both the logon and admin rights
1952                 // (check occurs when taking away one of these rights from such a member)
1953                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1954                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1955                    )
1956                 {
1957                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1958                         if (mysql_num_rows($r) < 2)
1959                                 $this->error(_ERROR_ATLEASTONEADMIN);
1960                 }
1961
1962                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1963                         $mem->setDisplayName($name);
1964                         if ($password)
1965                                 $mem->setPassword($password);
1966                 }
1967
1968                 $oldEmail = $mem->getEmail();
1969
1970                 $mem->setRealName($realname);
1971                 $mem->setEmail($email);
1972                 $mem->setURL($url);
1973                 $mem->setNotes($notes);
1974                 $mem->setLanguage($deflang);
1975
1976
1977                 // only allow super-admins to make changes to the admin status
1978                 if ($member->isAdmin()) {
1979                         $mem->setAdmin($admin);
1980                         $mem->setCanLogin($canlogin);
1981                 }
1982
1983
1984                 $mem->write();
1985
1986                 // store plugin options
1987                 $aOptions = requestArray('plugoption');
1988                 NucleusPlugin::_applyPluginOptions($aOptions);
1989                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
1990
1991                 // if email changed, generate new password
1992                 if ($oldEmail != $mem->getEmail())
1993                 {
1994                         $mem->sendActivationLink('addresschange', $oldEmail);
1995                         // logout member
1996                         $mem->newCookieKey();
1997
1998                         // only log out if the member being edited is the current member.
1999                         if ($member->getID() == $memberid)
2000                                 $member->logout();
2001                         $this->action_login(_MSG_ACTIVATION_SENT, 0);
2002                         return;
2003                 }
2004
2005
2006                 if (  ( $mem->getID() == $member->getID() )
2007                    && ( $mem->getDisplayName() != $member->getDisplayName() )
2008                    ) {
2009                         $mem->newCookieKey();
2010                         $member->logout();
2011                         $this->action_login(_MSG_LOGINAGAIN, 0);
2012                 } else {
2013                         $this->action_overview(_MSG_SETTINGSCHANGED);
2014                 }
2015         }
2016
2017         /**
2018          * @todo document this
2019          */
2020         function action_memberadd() {
2021                 global $member, $manager;
2022
2023                 // check if allowed
2024                 $member->isAdmin() or $this->disallow();
2025
2026                 if (postVar('password') != postVar('repeatpassword'))
2027                         $this->error(_ERROR_PASSWORDMISMATCH);
2028                 if (strlen(postVar('password')) < 6)
2029                         $this->error(_ERROR_PASSWORDTOOSHORT);
2030
2031                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
2032                 if ($res != 1)
2033                         $this->error($res);
2034
2035                 // fire PostRegister event
2036                 $newmem = new MEMBER();
2037                 $newmem->readFromName(postVar('name'));
2038                 $manager->notify('PostRegister',array('member' => &$newmem));
2039
2040                 $this->action_usermanagement();
2041         }
2042
2043         /**
2044          * Account activation
2045          *
2046          * @author dekarma
2047          */
2048         function action_activate() {
2049
2050                 $key = getVar('key');
2051                 $this->_showActivationPage($key);
2052         }
2053
2054         /**
2055          * @todo document this
2056          */
2057         function _showActivationPage($key, $message = '')
2058         {
2059                 global $manager;
2060
2061                 // clean up old activation keys
2062                 MEMBER::cleanupActivationTable();
2063
2064                 // get activation info
2065                 $info = MEMBER::getActivationInfo($key);
2066
2067                 if (!$info)
2068                         $this->error(_ERROR_ACTIVATE);
2069
2070                 $mem = MEMBER::createFromId($info->vmember);
2071
2072                 if (!$mem)
2073                         $this->error(_ERROR_ACTIVATE);
2074
2075                 $text = '';
2076                 $title = '';
2077                 $bNeedsPasswordChange = true;
2078
2079                 switch ($info->vtype)
2080                 {
2081                         case 'forgot':
2082                                 $title = _ACTIVATE_FORGOT_TITLE;
2083                                 $text = _ACTIVATE_FORGOT_TEXT;
2084                                 break;
2085                         case 'register':
2086                                 $title = _ACTIVATE_REGISTER_TITLE;
2087                                 $text = _ACTIVATE_REGISTER_TEXT;
2088                                 break;
2089                         case 'addresschange':
2090                                 $title = _ACTIVATE_CHANGE_TITLE;
2091                                 $text = _ACTIVATE_CHANGE_TEXT;
2092                                 $bNeedsPasswordChange = false;
2093                                 MEMBER::activate($key);
2094                                 break;
2095                 }
2096
2097                 $aVars = array(
2098                         'memberName' => htmlspecialchars($mem->getDisplayName())
2099                 );
2100                 $title = TEMPLATE::fill($title, $aVars);
2101                 $text = TEMPLATE::fill($text, $aVars);
2102
2103                 $this->pagehead();
2104
2105                         echo '<h2>' , $title, '</h2>';
2106                         echo '<p>' , $text, '</p>';
2107
2108                         if ($message != '')
2109                         {
2110                                 echo '<p class="error">',$message,'</p>';
2111                         }
2112
2113                         if ($bNeedsPasswordChange)
2114                         {
2115                                 ?>
2116                                         <div><form action="index.php" method="post">
2117
2118                                                 <input type="hidden" name="action" value="activatesetpwd" />
2119                                                 <?php $manager->addTicketHidden() ?>
2120                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />
2121
2122                                                 <table><tr>
2123                                                         <td><?php echo _MEMBERS_PWD?></td>
2124                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>
2125                                                 </tr><tr>
2126                                                         <td><?php echo _MEMBERS_REPPWD?></td>
2127                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2128                                                 <?php
2129
2130                                                         global $manager;
2131                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2132
2133                                                 ?>
2134                                                 </tr><tr>
2135                                                         <td><?php echo _MEMBERS_SETPWD ?></td>
2136                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2137                                                 </tr></table>
2138
2139
2140                                         </form></div>
2141
2142                                 <?php
2143
2144                         }
2145
2146                 $this->pagefoot();
2147
2148         }
2149
2150         /**
2151          * Account activation - set password part
2152          *
2153          * @author dekarma
2154          */
2155         function action_activatesetpwd() {
2156
2157                 $key = postVar('key');
2158
2159                 // clean up old activation keys
2160                 MEMBER::cleanupActivationTable();
2161
2162                 // get activation info
2163                 $info = MEMBER::getActivationInfo($key);
2164
2165                 if (!$info || ($info->type == 'addresschange'))
2166                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2167
2168                 $mem = MEMBER::createFromId($info->vmember);
2169
2170                 if (!$mem)
2171                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2172
2173                 $password               = postVar('password');
2174                 $repeatpassword = postVar('repeatpassword');
2175
2176                 if ($password != $repeatpassword)
2177                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2178
2179                 if ($password && (strlen($password) < 6))
2180                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2181
2182                 $error = '';
2183                 global $manager;
2184                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2185                 if ($error != '')
2186                         return $this->_showActivationPage($key, $error);
2187
2188
2189                 // set password
2190                 $mem->setPassword($password);
2191                 $mem->write();
2192
2193                 // do the activation
2194                 MEMBER::activate($key);
2195
2196                 $this->pagehead();
2197                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2198                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2199                 $this->pagefoot();
2200         }
2201
2202         /**
2203          * Manage team
2204          */
2205         function action_manageteam() {
2206                 global $member, $manager;
2207
2208                 $blogid = intRequestVar('blogid');
2209
2210                 // check if allowed
2211                 $member->blogAdminRights($blogid) or $this->disallow();
2212
2213                 $this->pagehead();
2214
2215                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2216
2217                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2218
2219                 echo '<h3>' . _TEAM_CURRENT . '</h3>';
2220
2221
2222
2223                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2224                            . ' FROM '.sql_table('member').', '.sql_table('team')
2225                            . ' WHERE tmember=mnumber and tblog=' . $blogid;
2226
2227                 $template['content'] = 'teamlist';
2228                 $template['tabindex'] = 10;
2229
2230                 $manager->loadClass("ENCAPSULATE");
2231                 $batch =& new BATCH('team');
2232                 $batch->showlist($query, 'table', $template);
2233
2234                 ?>
2235                         <h3><?php echo _TEAM_ADDNEW?></h3>
2236
2237                         <form method='post' action='index.php'><div>
2238
2239                         <input type='hidden' name='action' value='teamaddmember' />
2240                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2241                         <?php $manager->addTicketHidden() ?>
2242
2243                         <table><tr>
2244                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2245                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed
2246                                         $query =  'SELECT mname as text, mnumber as value'
2247                                                    . ' FROM '.sql_table('member');
2248
2249                                         $template['name'] = 'memberid';
2250                                         $template['tabindex'] = 10000;
2251                                         showlist($query,'select',$template);
2252                                 ?></td>
2253                         </tr><tr>
2254                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2255                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2256                         </tr><tr>
2257                                 <td><?php echo _TEAM_ADD?></td>
2258                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2259                         </tr></table>
2260
2261                         </div></form>
2262                 <?php
2263                 $this->pagefoot();
2264         }
2265
2266         /**
2267          * Add member to team
2268          */
2269         function action_teamaddmember() {
2270                 global $member, $manager;
2271
2272                 $memberid = intPostVar('memberid');
2273                 $blogid = intPostVar('blogid');
2274                 $admin = intPostVar('admin');
2275
2276                 // check if allowed
2277                 $member->blogAdminRights($blogid) or $this->disallow();
2278
2279                 $blog =& $manager->getBlog($blogid);
2280                 if (!$blog->addTeamMember($memberid, $admin))
2281                         $this->error(_ERROR_ALREADYONTEAM);
2282
2283                 $this->action_manageteam();
2284
2285         }
2286
2287         /**
2288          * @todo document this
2289          */
2290         function action_teamdelete() {
2291                 global $member, $manager;
2292
2293                 $memberid = intRequestVar('memberid');
2294                 $blogid = intRequestVar('blogid');
2295
2296                 // check if allowed
2297                 $member->blogAdminRights($blogid) or $this->disallow();
2298
2299                 $teammem = MEMBER::createFromID($memberid);
2300                 $blog =& $manager->getBlog($blogid);
2301
2302                 $this->pagehead();
2303                 ?>
2304                         <h2><?php echo _DELETE_CONFIRM?></h2>
2305
2306                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  htmlspecialchars($teammem->getDisplayName()) ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>
2307                         </p>
2308
2309
2310                         <form method="post" action="index.php"><div>
2311                         <input type="hidden" name="action" value="teamdeleteconfirm" />
2312                         <?php $manager->addTicketHidden() ?>
2313                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2314                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2315                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2316                         </div></form>
2317                 <?php
2318                 $this->pagefoot();
2319         }
2320
2321         /**
2322          * @todo document this
2323          */
2324         function action_teamdeleteconfirm() {
2325                 global $member;
2326
2327                 $memberid = intRequestVar('memberid');
2328                 $blogid = intRequestVar('blogid');
2329
2330                 $error = $this->deleteOneTeamMember($blogid, $memberid);
2331                 if ($error)
2332                         $this->error($error);
2333
2334
2335                 $this->action_manageteam();
2336         }
2337
2338         /**
2339          * @todo document this
2340          */
2341         function deleteOneTeamMember($blogid, $memberid) {
2342                 global $member, $manager;
2343
2344                 $blogid = intval($blogid);
2345                 $memberid = intval($memberid);
2346
2347                 // check if allowed
2348                 if (!$member->blogAdminRights($blogid))
2349                         return _ERROR_DISALLOWED;
2350
2351                 // check if: - there remains at least one blog admin
2352                 //           - (there remains at least one team member)
2353                 $tmem = MEMBER::createFromID($memberid);
2354
2355                 $manager->notify('PreDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2356
2357                 if ($tmem->isBlogAdmin($blogid)) {
2358                         // check if there are more blog members left and at least one admin
2359                         // (check for at least two admins before deletion)
2360                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2361                         $r = sql_query($query);
2362                         if (mysql_num_rows($r) < 2)
2363                                 return _ERROR_ATLEASTONEBLOGADMIN;
2364                 }
2365
2366                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2367                 sql_query($query);
2368
2369                 $manager->notify('PostDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2370
2371                 return '';
2372         }
2373
2374         /**
2375          * @todo document this
2376          */
2377         function action_teamchangeadmin() {
2378                 global $member;
2379
2380                 $blogid = intRequestVar('blogid');
2381                 $memberid = intRequestVar('memberid');
2382
2383                 // check if allowed
2384                 $member->blogAdminRights($blogid) or $this->disallow();
2385
2386                 $mem = MEMBER::createFromID($memberid);
2387
2388                 // don't allow when there is only one admin at this moment
2389                 if ($mem->isBlogAdmin($blogid)) {
2390                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2391                         if (mysql_num_rows($r) == 1)
2392                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2393                 }
2394
2395                 if ($mem->isBlogAdmin($blogid))
2396                         $newval = 0;
2397                 else
2398                         $newval = 1;
2399
2400                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2401                 sql_query($query);
2402
2403                 // only show manageteam if member did not change its own admin privileges
2404                 if ($member->isBlogAdmin($blogid))
2405                         $this->action_manageteam();
2406                 else
2407                         $this->action_overview(_MSG_ADMINCHANGED);
2408         }
2409
2410         /**
2411          * @todo document this
2412          */
2413         function action_blogsettings() {
2414                 global $member, $manager;
2415
2416                 $blogid = intRequestVar('blogid');
2417
2418                 // check if allowed
2419                 $member->blogAdminRights($blogid) or $this->disallow();
2420
2421                 $blog =& $manager->getBlog($blogid);
2422
2423                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2424                 $this->pagehead($extrahead);
2425
2426                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2427                 ?>
2428                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2429
2430                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2431
2432                 <p>Members currently on your team:
2433                 <?php
2434                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2435                         $aMemberNames = array();
2436                         while ($o = mysql_fetch_object($res))
2437                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');
2438                         echo implode(',', $aMemberNames);
2439                 ?>
2440                 </p>
2441
2442
2443
2444                 <p>
2445                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2446                 </p>
2447
2448                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2449
2450                 <form method="post" action="index.php"><div>
2451
2452                 <input type="hidden" name="action" value="blogsettingsupdate" />
2453                 <?php $manager->addTicketHidden() ?>
2454                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2455                 <table><tr>
2456                         <td><?php echo _EBLOG_NAME?></td>
2457                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>
2458                 </tr><tr>
2459                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2460                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2461                         </td>
2462                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>
2463                 </tr><tr>
2464                         <td><?php echo _EBLOG_DESC?></td>
2465                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>
2466                 </tr><tr>
2467                         <td><?php echo _EBLOG_URL?></td>
2468                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>
2469                 </tr><tr>
2470                         <td><?php echo _EBLOG_DEFSKIN?>
2471                                 <?php help('blogdefaultskin'); ?>
2472                         </td>
2473                         <td>
2474                                 <?php
2475                                         $query =  'SELECT sdname as text, sdnumber as value'
2476                                                    . ' FROM '.sql_table('skin_desc');
2477                                         $template['name'] = 'defskin';
2478                                         $template['selected'] = $blog->getDefaultSkin();
2479                                         $template['tabindex'] = 50;
2480                                         showlist($query,'select',$template);
2481                                 ?>
2482
2483                         </td>
2484                 </tr><tr>
2485                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2486                         </td>
2487                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2488                 </tr><tr>
2489                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2490                         </td>
2491                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2492                 </tr><tr>
2493                         <td><?php echo _EBLOG_DISABLECOMMENTS?>
2494                         </td>
2495                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2496                 </tr><tr>
2497                         <td><?php echo _EBLOG_ANONYMOUS?>
2498                         </td>
2499                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2500                 </tr><tr>
2501         <td><?php echo _EBLOG_REQUIREDEMAIL?>
2502                  </td>
2503                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2504           </tr><tr>
2505                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2506                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
2507                 </tr><tr>
2508                         <td><?php echo _EBLOG_NOTIFY_ON?></td>
2509                         <td>
2510                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2511                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2512                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2513                                 <br />
2514                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2515                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2516                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2517                                 <br />
2518                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2519                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2520                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2521                         </td>
2522                 </tr><tr>
2523                 <?
2524                 if (numberOfEventSubscriber('SendPing') > 0) {
2525                 ?>
2526                         <td><?php echo _EBLOG_PING?> <?php help('sendping'); ?></td>
2527                         <td><?php $this->input_yesno('sendping',$blog->sendPing(),85); ?></td>
2528                 </tr><tr>
2529                 <?
2530                 }
2531                 ?>
2532                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2533                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>
2534                 </tr><tr>
2535                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2536                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>
2537                 </tr><tr>
2538                         <td><?php echo _EBLOG_DEFCAT?></td>
2539                         <td>
2540                                 <?php
2541                                         $query =  'SELECT cname as text, catid as value'
2542                                                    . ' FROM '.sql_table('category')
2543                                                    . ' WHERE cblog=' . $blog->getID();
2544                                         $template['name'] = 'defcat';
2545                                         $template['selected'] = $blog->getDefaultCategory();
2546                                         $template['tabindex'] = 110;
2547                                         showlist($query,'select',$template);
2548                                 ?>
2549                         </td>
2550                 </tr><tr>
2551                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2552                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
2553                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2554                                 </td>
2555                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>
2556                 </tr><tr>
2557                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2558                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2559                 </tr>
2560                 <?php
2561                         // plugin options
2562                         $this->_insertPluginOptions('blog',$blogid);
2563                 ?>
2564                 <tr>
2565                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2566                 </tr><tr>
2567                         <td><?php echo _EBLOG_CHANGE?></td>
2568                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2569                 </tr></table>
2570
2571                 </div></form>
2572
2573                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2574
2575
2576                 <?php
2577                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2578                 $template['content'] = 'categorylist';
2579                 $template['tabindex'] = 200;
2580
2581                 $manager->loadClass("ENCAPSULATE");
2582                 $batch =& new BATCH('category');
2583                 $batch->showlist($query,'table',$template);
2584
2585                 ?>
2586
2587
2588                 <form action="index.php" method="post"><div>
2589                 <input name="action" value="categorynew" type="hidden" />
2590                 <?php $manager->addTicketHidden() ?>
2591                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2592
2593                 <table><tr>
2594                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2595                 </tr><tr>
2596                         <td><?php echo _EBLOG_CAT_NAME?></td>
2597                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2598                 </tr><tr>
2599                         <td><?php echo _EBLOG_CAT_DESC?></td>
2600                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2601                 </tr><tr>
2602                         <td><?php echo _EBLOG_CAT_CREATE?></td>
2603                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2604                 </tr></table>
2605
2606                 </div></form>
2607
2608                 <?php
2609
2610                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2611
2612                         $manager->notify(
2613                                 'BlogSettingsFormExtras',
2614                                 array(
2615                                         'blog' => &$blog
2616                                 )
2617                         );
2618
2619                 $this->pagefoot();
2620         }
2621
2622         /**
2623          * @todo document this
2624          */
2625         function action_categorynew() {
2626                 global $member, $manager;
2627
2628                 $blogid = intRequestVar('blogid');
2629
2630                 $member->blogAdminRights($blogid) or $this->disallow();
2631
2632                 $cname = postVar('cname');
2633                 $cdesc = postVar('cdesc');
2634
2635                 if (!isValidCategoryName($cname))
2636                         $this->error(_ERROR_BADCATEGORYNAME);
2637
2638                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
2639                 $res = sql_query($query);
2640                 if (mysql_num_rows($res) > 0)
2641                         $this->error(_ERROR_DUPCATEGORYNAME);
2642
2643                 $blog           =& $manager->getBlog($blogid);
2644                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2645
2646                 $this->action_blogsettings();
2647         }
2648
2649         /**
2650          * @todo document this
2651          */
2652         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2653                 global $member, $manager;
2654
2655                 if ($blogid == '')
2656                         $blogid = intGetVar('blogid');
2657                 else
2658                         $blogid = intval($blogid);
2659                 if ($catid == '')
2660                         $catid = intGetVar('catid');
2661                 else
2662                         $catid = intval($catid);
2663
2664                 $member->blogAdminRights($blogid) or $this->disallow();
2665
2666                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2667                 $obj = mysql_fetch_object($res);
2668
2669                 $cname = $obj->cname;
2670                 $cdesc = $obj->cdesc;
2671
2672                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2673                 $this->pagehead($extrahead);
2674
2675                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2676
2677                 ?>
2678                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>
2679                 <form method='post' action='index.php'><div>
2680                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2681                 <input name="catid" type="hidden" value="<?php echo $catid?>" />
2682                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />
2683                 <input name="action" type="hidden" value="categoryupdate" />
2684                 <?php $manager->addTicketHidden(); ?>
2685
2686                 <table><tr>
2687                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2688                 </tr><tr>
2689                         <td><?php echo _EBLOG_CAT_NAME?></td>
2690                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>
2691                 </tr><tr>
2692                         <td><?php echo _EBLOG_CAT_DESC?></td>
2693                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>
2694                 </tr>
2695                 <?php
2696                         // insert plugin options
2697                         $this->_insertPluginOptions('category',$catid);
2698                 ?>
2699                 <tr>
2700                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2701                 </tr><tr>
2702                         <td><?php echo _EBLOG_CAT_UPDATE?></td>
2703                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2704                 </tr></table>
2705
2706                 </div></form>
2707                 <?php
2708                 $this->pagefoot();
2709         }
2710
2711         /**
2712          * @todo document this
2713          */
2714         function action_categoryupdate() {
2715                 global $member, $manager;
2716
2717                 $blogid = intPostVar('blogid');
2718                 $catid = intPostVar('catid');
2719                 $cname = postVar('cname');
2720                 $cdesc = postVar('cdesc');
2721                 $desturl = postVar('desturl');
2722
2723                 $member->blogAdminRights($blogid) or $this->disallow();
2724
2725                 if (!isValidCategoryName($cname))
2726                         $this->error(_ERROR_BADCATEGORYNAME);
2727
2728                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2729                 $res = sql_query($query);
2730                 if (mysql_num_rows($res) > 0)
2731                         $this->error(_ERROR_DUPCATEGORYNAME);
2732
2733                 $query =  'UPDATE '.sql_table('category').' SET'
2734                            . " cname='" . addslashes($cname) . "',"
2735                            . " cdesc='" . addslashes($cdesc) . "'"
2736                            . " WHERE catid=" . $catid;
2737
2738                 sql_query($query);
2739
2740                 // store plugin options
2741                 $aOptions = requestArray('plugoption');
2742                 NucleusPlugin::_applyPluginOptions($aOptions);
2743                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2744
2745
2746                 if ($desturl) {
2747                         redirect($desturl);
2748                         exit;
2749                 } else {
2750                         $this->action_blogsettings();
2751                 }
2752         }
2753
2754         /**
2755          * @todo document this
2756          */
2757         function action_categorydelete() {
2758                 global $member, $manager;
2759
2760                 $blogid = intRequestVar('blogid');
2761                 $catid = intRequestVar('catid');
2762
2763                 $member->blogAdminRights($blogid) or $this->disallow();
2764
2765                 $blog =& $manager->getBlog($blogid);
2766
2767                 // check if the category is valid
2768                 if (!$blog->isValidCategory($catid))
2769                         $this->error(_ERROR_NOSUCHCATEGORY);
2770
2771                 // don't allow deletion of default category
2772                 if ($blog->getDefaultCategory() == $catid)
2773                         $this->error(_ERROR_DELETEDEFCATEGORY);
2774
2775                 // check if catid is the only category left for blogid
2776                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2777                 $res = sql_query($query);
2778                 if (mysql_num_rows($res) == 1)
2779                         $this->error(_ERROR_DELETELASTCATEGORY);
2780
2781
2782                 $this->pagehead();
2783                 ?>
2784                         <h2><?php echo _DELETE_CONFIRM?></h2>
2785
2786                         <div>
2787                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  htmlspecialchars($blog->getCategoryName($catid))?></b>
2788                         </div>
2789
2790                         <form method="post" action="index.php"><div>
2791                         <input type="hidden" name="action" value="categorydeleteconfirm" />
2792                         <?php $manager->addTicketHidden() ?>
2793                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2794                         <input type="hidden" name="catid" value="<?php echo $catid?>" />
2795                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2796                         </div></form>
2797                 <?php
2798                 $this->pagefoot();
2799         }
2800
2801         /**
2802          * @todo document this
2803          */
2804         function action_categorydeleteconfirm() {
2805                 global $member, $manager;
2806
2807                 $blogid = intRequestVar('blogid');
2808                 $catid = intRequestVar('catid');
2809
2810                 $member->blogAdminRights($blogid) or $this->disallow();
2811
2812                 $error = $this->deleteOneCategory($catid);
2813                 if ($error)
2814                         $this->error($error);
2815
2816                 $this->action_blogsettings();
2817         }
2818
2819         /**
2820          * @todo document this
2821          */
2822         function deleteOneCategory($catid) {
2823                 global $manager, $member;
2824
2825                 $catid = intval($catid);
2826
2827                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2828
2829                 $blogid = getBlogIDFromCatID($catid);
2830
2831                 if (!$member->blogAdminRights($blogid))
2832                         return ERROR_DISALLOWED;
2833
2834                 // get blog
2835                 $blog =& $manager->getBlog($blogid);
2836
2837                 // check if the category is valid
2838                 if (!$blog || !$blog->isValidCategory($catid))
2839                         return _ERROR_NOSUCHCATEGORY;
2840
2841                 $destcatid = $blog->getDefaultCategory();
2842
2843                 // don't allow deletion of default category
2844                 if ($blog->getDefaultCategory() == $catid)
2845                         return _ERROR_DELETEDEFCATEGORY;
2846
2847                 // check if catid is the only category left for blogid
2848                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2849                 $res = sql_query($query);
2850                 if (mysql_num_rows($res) == 1)
2851                         return _ERROR_DELETELASTCATEGORY;
2852
2853                 // change category for all items to the default category
2854                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2855                 sql_query($query);
2856
2857                 // delete all associated plugin options
2858                 NucleusPlugin::_deleteOptionValues('category', $catid);
2859
2860                 // delete category
2861                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2862                 sql_query($query);
2863
2864                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2865
2866         }
2867
2868         /**
2869          * @todo document this
2870          */
2871         function moveOneCategory($catid, $destblogid) {
2872                 global $manager, $member;
2873
2874                 $catid = intval($catid);
2875                 $destblogid = intval($destblogid);
2876
2877                 $blogid = getBlogIDFromCatID($catid);
2878
2879                 // mover should have admin rights on both blogs
2880                 if (!$member->blogAdminRights($blogid))
2881                         return _ERROR_DISALLOWED;
2882                 if (!$member->blogAdminRights($destblogid))
2883                         return _ERROR_DISALLOWED;
2884
2885                 // cannot move to self
2886                 if ($blogid == $destblogid)
2887                         return _ERROR_MOVETOSELF;
2888
2889                 // get blogs
2890                 $blog =& $manager->getBlog($blogid);
2891                 $destblog =& $manager->getBlog($destblogid);
2892
2893                 // check if the category is valid
2894                 if (!$blog || !$blog->isValidCategory($catid))
2895                         return _ERROR_NOSUCHCATEGORY;
2896
2897                 // don't allow default category to be moved
2898                 if ($blog->getDefaultCategory() == $catid)
2899                         return _ERROR_MOVEDEFCATEGORY;
2900
2901                 $manager->notify(
2902                         'PreMoveCategory',
2903                         array(
2904                                 'catid' => &$catid,
2905                                 'sourceblog' => &$blog,
2906                                 'destblog' => &$destblog
2907                         )
2908                 );
2909
2910                 // update comments table (cblog)
2911                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2912                 $items = sql_query($query);
2913                 while ($oItem = mysql_fetch_object($items)) {
2914                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2915                 }
2916
2917                 // update items (iblog)
2918                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2919                 sql_query($query);
2920
2921                 // move category
2922                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2923                 sql_query($query);
2924
2925                 $manager->notify(
2926                         'PostMoveCategory',
2927                         array(
2928                                 'catid' => &$catid,
2929                                 'sourceblog' => &$blog,
2930                                 'destblog' => $destblog
2931                         )
2932                 );
2933
2934         }
2935
2936         /**
2937          * @todo document this
2938          */
2939         function action_blogsettingsupdate() {
2940                 global $member, $manager;
2941
2942                 $blogid = intRequestVar('blogid');
2943
2944                 $member->blogAdminRights($blogid) or $this->disallow();
2945
2946                 $blog =& $manager->getBlog($blogid);
2947
2948                 $notify                 = trim(postVar('notify'));
2949                 $shortname              = trim(postVar('shortname'));
2950                 $updatefile             = trim(postVar('update'));
2951
2952                 $notifyComment  = intPostVar('notifyComment');
2953                 $notifyVote             = intPostVar('notifyVote');
2954                 $notifyNewItem  = intPostVar('notifyNewItem');
2955
2956                 if ($notifyComment == 0)        $notifyComment = 1;
2957                 if ($notifyVote == 0)           $notifyVote = 1;
2958                 if ($notifyNewItem == 0)        $notifyNewItem = 1;
2959
2960                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2961
2962
2963                 if ($notify) {
2964                         $not =& new NOTIFICATION($notify);
2965                         if (!$not->validAddresses())
2966                                 $this->error(_ERROR_BADNOTIFY);
2967
2968                 }
2969
2970                 if (!isValidShortName($shortname))
2971                         $this->error(_ERROR_BADSHORTBLOGNAME);
2972
2973                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
2974                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2975
2976                 // check if update file is writable
2977                 if ($updatefile && !is_writeable($updatefile))
2978                         $this->error(_ERROR_UPDATEFILE);
2979
2980                 $blog->setName(trim(postVar('name')));
2981                 $blog->setShortName($shortname);
2982                 $blog->setNotifyAddress($notify);
2983                 $blog->setNotifyType($notifyType);
2984                 $blog->setMaxComments(postVar('maxcomments'));
2985                 $blog->setCommentsEnabled(postVar('comments'));
2986                 $blog->setTimeOffset(postVar('timeoffset'));
2987                 $blog->setUpdateFile($updatefile);
2988                 $blog->setURL(trim(postVar('url')));
2989                 $blog->setDefaultSkin(intPostVar('defskin'));
2990                 $blog->setDescription(trim(postVar('desc')));
2991                 $blog->setPublic(postVar('public'));
2992                 $blog->setPingUserland(postVar('sendping'));
2993                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2994                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2995                 $blog->setDefaultCategory(intPostVar('defcat'));
2996                 $blog->setSearchable(intPostVar('searchable'));
2997                 $blog->setEmailRequired(intPostVar('reqemail'));
2998
2999                 $blog->writeSettings();
3000
3001                 // store plugin options
3002                 $aOptions = requestArray('plugoption');
3003                 NucleusPlugin::_applyPluginOptions($aOptions);
3004                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
3005
3006
3007                 $this->action_overview(_MSG_SETTINGSCHANGED);
3008         }
3009
3010         /**
3011          * @todo document this
3012          */
3013         function action_deleteblog() {
3014                 global $member, $CONF, $manager;
3015
3016                 $blogid = intRequestVar('blogid');
3017
3018                 $member->blogAdminRights($blogid) or $this->disallow();
3019
3020                 // check if blog is default blog
3021                 if ($CONF['DefaultBlog'] == $blogid)
3022                         $this->error(_ERROR_DELDEFBLOG);
3023
3024                 $blog =& $manager->getBlog($blogid);
3025
3026                 $this->pagehead();
3027                 ?>
3028                         <h2><?php echo _DELETE_CONFIRM?></h2>
3029
3030                         <p><?php echo _WARNINGTXT_BLOGDEL?>
3031                         </p>
3032
3033                         <div>
3034                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>
3035                         </div>
3036
3037                         <form method="post" action="index.php"><div>
3038                         <input type="hidden" name="action" value="deleteblogconfirm" />
3039                         <?php $manager->addTicketHidden() ?>
3040                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
3041                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3042                         </div></form>
3043                 <?php
3044                 $this->pagefoot();
3045         }
3046
3047         /**
3048          * @todo document this
3049          */
3050         function action_deleteblogconfirm() {
3051                 global $member, $CONF, $manager;
3052
3053                 $blogid = intRequestVar('blogid');
3054
3055                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3056
3057                 $member->blogAdminRights($blogid) or $this->disallow();
3058
3059                 // check if blog is default blog
3060                 if ($CONF['DefaultBlog'] == $blogid)
3061                         $this->error(_ERROR_DELDEFBLOG);
3062
3063                 // delete all comments
3064                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3065                 sql_query($query);
3066
3067                 // delete all items
3068                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3069                 sql_query($query);
3070
3071                 // delete all team members
3072                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3073                 sql_query($query);
3074
3075                 // delete all bans
3076                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3077                 sql_query($query);
3078
3079                 // delete all categories
3080                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3081                 sql_query($query);
3082
3083                 // delete all associated plugin options
3084                 NucleusPlugin::_deleteOptionValues('blog', $blogid);
3085
3086                 // delete the blog itself
3087                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3088                 sql_query($query);
3089
3090                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3091
3092                 $this->action_overview(_DELETED_BLOG);
3093         }
3094
3095         /**
3096          * @todo document this
3097          */
3098         function action_memberdelete() {
3099                 global $member, $manager;
3100
3101                 $memberid = intRequestVar('memberid');
3102
3103                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3104
3105                 $mem = MEMBER::createFromID($memberid);
3106
3107                 $this->pagehead();
3108                 ?>
3109                         <h2><?php echo _DELETE_CONFIRM?></h2>
3110
3111                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo htmlspecialchars($mem->getDisplayName()) ?></b>
3112                         </p>
3113
3114                         <p>
3115                         Please note that media files will <b>NOT</b> be deleted. (At least not in this Nucleus version)
3116                         </p>
3117
3118                         <form method="post" action="index.php"><div>
3119                         <input type="hidden" name="action" value="memberdeleteconfirm" />
3120                         <?php $manager->addTicketHidden() ?>
3121                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3122                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3123                         </div></form>
3124                 <?php
3125                 $this->pagefoot();
3126         }
3127
3128         /**
3129          * @todo document this
3130          */
3131         function action_memberdeleteconfirm() {
3132                 global $member;
3133
3134                 $memberid = intRequestVar('memberid');
3135
3136                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3137
3138                 $error = $this->deleteOneMember($memberid);
3139                 if ($error)
3140                         $this->error($error);
3141
3142                 if ($member->isAdmin())
3143                         $this->action_usermanagement();
3144                 else
3145                         $this->action_overview(_DELETED_MEMBER);
3146         }
3147
3148         /**
3149          * @static
3150          * @todo document this
3151          */
3152         function deleteOneMember($memberid) {
3153                 global $manager;
3154
3155                 $memberid = intval($memberid);
3156                 $mem = MEMBER::createFromID($memberid);
3157
3158                 if (!$mem->canBeDeleted())
3159                         return _ERROR_DELETEMEMBER;
3160
3161                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3162
3163                 /* unlink comments from memberid */
3164                 $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
3165                                         .'" WHERE cmember='.$memberid;
3166                 sql_query($query);
3167
3168                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3169                 sql_query($query);
3170
3171                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3172                 sql_query($query);
3173
3174                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3175                 sql_query($query);
3176
3177                 // delete all associated plugin options
3178                 NucleusPlugin::_deleteOptionValues('member', $memberid);
3179
3180                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3181
3182                 return '';
3183         }
3184
3185         /**
3186          * @todo document this
3187          */
3188         function action_createnewlog() {
3189                 global $member, $CONF, $manager;
3190
3191                 // Only Super-Admins can do this
3192                 $member->isAdmin() or $this->disallow();
3193
3194                 $this->pagehead();
3195
3196                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3197                 ?>
3198                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3199
3200                 <h3>æ³¡¦§ïäº¶ç@¡¦/h3>
3201
3202                 <p>ä½Øå¡¦¡¦¡¦¡â¡¦Þä!£ã¡ãáà¢ä\8e¶¶æ\8e¦Ðä!¡¦strong>æ³¡¦§ïäº¶ç@¡¦/strong> ¡¦Ää!¾ã¡ú¡¦´æ\8e¨ã¡ð§ì²ä!Êä!¡¦/p>
3203
3204                 <p>åô°ã¡÷¡¦§Øeblog¡¦Ää\8e»Øå¡¦¡¦Îä!Þå]¸ä!¡¦\80¢ä!Æä!Álog¡¦¡¦£ááâ¡¦£î¥â¹ã¡ù¡¦¶ä!Þä"¢ä!¡¦Ëí¡¦5¡¦ÄæS¹ä¡¦¡¦Îä!¡¦¡ê¡¦ºä!¾ã¡ù¡¦¤åÇí¡¦5¡¦°Ô¡¦¤ã¡â¡¦´ä!¾ã¡ù:</p>
3205
3206                 <ol>
3207                         <li><strong>ç°¡å¹ø¡¦¡¦Ëí¡¦5:</strong> <code>index.php</code>¡¦¡¦£åè£½ã£òä½Øä"´ä ¢åÇèááÎä!¡¦log¡¦ÄæÝäéâ\8e¸¡¦Òä"¶ä"°ä!¡¦!¡¦£çåù´ã£ò¡¦ ¡¦°ä!¾ã¡ù¡¦¡¦¡¦Æä!¡¦£çåù´ã¡çëåRç´°ã¡è¥à¢ä\8e»Øå¡¦å¾¸ä!¡¦¡¨ç¤ºã¡õ¡¦¸ä!¾ã¡ù¡¦¡¦/li>
3208                         <li><strong>é«ÐåY¡¦¡åçö¹æ¡¦:</strong> ¡¦¾å×äááÁlog¡¦§ä½¿¡¦¡¦¡÷¡¦¡¦¡ä¡¦¶ä"¹ã£ç¥ã³ã¡æ\8eÜcode>otherblog</code>¡¦¡¦¡ä¡¦¡¦"³ã¥îáã²ä"Ää\8e»¿ã¡â¥áÞæ\8e¦Ðæ\8e½°ã£ò¡¦ ¡¦°ä!¾ã¡ù¡¦¤ä!Æä!¡¦Ëí¡¦5¡¦§ã¡è¥à¢å0¸ä!Ðä#Ôä#¼ã£ìåæ¡¦!§è£ååó°ã¡ç`log¡¦ÄåPÊç6¶ä!Òä"¶ä!Æä!¡¦¡ì¡¦¡¦¥ï¥á¡¦¡åáâ´ä!¾ã¡ù¡¦¡¦/li>
3209                 </ol>
3210
3211                 <h3>Weblog¡¦¡¦¡¦åæ¡¦/h3>
3212
3213                 <p>
3214                 <?php echo _EBLOG_CREATE_TEXT?>
3215                 </p>
3216
3217                 <form method="post" action="index.php"><div>
3218
3219                 <input type="hidden" name="action" value="addnewlog" />
3220                 <?php $manager->addTicketHidden() ?>
3221
3222
3223                 <table><tr>
3224                         <td><?php echo _EBLOG_NAME?></td>
3225                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3226                 </tr><tr>
3227                         <td><?php echo _EBLOG_SHORTNAME?>
3228                                 <?php help('shortblogname'); ?>
3229                         </td>
3230                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3231                 </tr><tr>
3232                         <td><?php echo _EBLOG_DESC?></td>
3233                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3234                 </tr><tr>
3235                         <td><?php echo _EBLOG_DEFSKIN?>
3236                                 <?php help('blogdefaultskin'); ?>
3237                         </td>
3238                         <td>
3239                                 <?php
3240                                         $query =  'SELECT sdname as text, sdnumber as value'
3241                                                    . ' FROM '.sql_table('skin_desc');
3242                                         $template['name'] = 'defskin';
3243                                         $template['tabindex'] = 50;
3244                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin
3245                                         showlist($query,'select',$template);
3246                                 ?>
3247                         </td>
3248                 </tr><tr>
3249                         <td><?php echo _EBLOG_OFFSET?>
3250                                 <?php help('blogtimeoffset'); ?>
3251                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
3252                         </td>
3253                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3254                 </tr><tr>
3255                         <td><?php echo _EBLOG_ADMIN?>
3256                                 <?php help('teamadmin'); ?>
3257                         </td>
3258                         <td><?php echo _EBLOG_ADMIN_MSG?></td>
3259                 </tr><tr>
3260                         <td><?php echo _EBLOG_CREATE?></td>
3261                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3262                 </tr></table>
3263
3264                 </div></form>
3265                 <?php
3266                 $this->pagefoot();
3267         }
3268
3269         /**
3270          * @todo document this
3271          */
3272         function action_addnewlog() {
3273                 global $member, $manager, $CONF;
3274
3275                 // Only Super-Admins can do this
3276                 $member->isAdmin() or $this->disallow();
3277
3278                 $bname                  = trim(postVar('name'));
3279                 $bshortname             = trim(postVar('shortname'));
3280                 $btimeoffset    = postVar('timeoffset');
3281                 $bdesc                  = trim(postVar('desc'));
3282                 $bdefskin               = postVar('defskin');
3283
3284                 if (!isValidShortName($bshortname))
3285                         $this->error(_ERROR_BADSHORTBLOGNAME);
3286
3287                 if ($manager->existsBlog($bshortname))
3288                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3289
3290                 $manager->notify(
3291                         'PreAddBlog',
3292                         array(
3293                                 'name' => &$bname,
3294                                 'shortname' => &$bshortname,
3295                                 'timeoffset' => &$btimeoffset,
3296                                 'description' => &$bdescription,
3297                                 'defaultskin' => &$bdefskin
3298                         )
3299                 );
3300
3301
3302                 // add slashes for sql queries
3303                 $bname =                addslashes($bname);
3304                 $bshortname =   addslashes($bshortname);
3305                 $btimeoffset =  addslashes($btimeoffset);
3306                 $bdesc =                addslashes($bdesc);
3307                 $bdefskin =     addslashes($bdefskin);
3308
3309                 // create blog
3310                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3311                 sql_query($query);
3312                 $blogid = mysql_insert_id();
3313                 $blog   =& $manager->getBlog($blogid);
3314
3315                 // create new category
3316                 sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, 'General','Items that do not fit in other categories')");
3317                 $catid = mysql_insert_id();
3318
3319                 // set as default category
3320                 $blog->setDefaultCategory($catid);
3321                 $blog->writeSettings();
3322
3323                 // create team member
3324                 $memberid = $member->getID();
3325                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3326                 sql_query($query);
3327
3328
3329                 $blog->additem($blog->getDefaultCategory(),'First Item','¡¦Æä"¸ä!¡¦¡â¡¦¡¦¢¡¡¦Öeblog¡¦¡¦¡ê¡¦Âä"¶åÓà¡¦Úä!¡¦£ááâ¤ã¥æ¡¦ ¡¦§ã¡ù¡¦¤æ¡¦éô±ã¡æ¡¦´ç9¤ã¡÷¡¦¡¦¡ä¡¦Þä! ¡¦¡¦!¡¦¡ë¡¦¾ã¡ä¡¦¾ã¡û¡¦Æä ¡¦,'',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3330
3331                 $manager->notify(
3332                         'PostAddBlog',
3333                         array(
3334                                 'blog' => &$blog
3335                         )
3336                 );
3337
3338                 $manager->notify(
3339                         'PostAddCategory',
3340                         array(
3341                                 'blog' => &$blog,
3342                                 'name' => 'General',
3343                                 'description' => 'Items that do not fit in other categories',
3344                                 'catid' => $catid
3345                         )
3346                 );
3347
3348                 $this->pagehead();
3349                 ?>
3350                 <h2>åô°ã¡÷¡¦§Øeblog¡¦¸ä\8e»Øå¡¦¡¦Êä"¸ä!¾ã¡÷¡¦¡¦/h2>
3351
3352                 <p>åô°ã¡÷¡¦§Øeblog ¡¦¡¦?php echo htmlspecialchars($bname)?>¡¦ºä!¸ä\8e»Øå¡¦¡¦Êä"¸ä!¾ã¡÷¡¦Þä ¤æUÔä!Âä!¡¦\80¢ä!Æä"¸ä!¡¦£ááâ¡¦£î¥â¹ã¡ù¡¦¶ä!Þä"¢ä!¡¦»¥ä¸¶ä!¡¦¡å¥á¡ã£é¡¦¶ä!¡¦±ëé¡¡¦!¡¦\80²ã£ó¡¦§ã¡ï¡¦ ¡¦Êä!¡¦ ¡¦/p>
3353
3354                 <ol>
3355                         <li><a href="#index_php">ç°¡å¹ø¡¦¡¦Ëí¡¦5: ä¸¶ä!¡¦£ê¥ã¼ã¥é¡¦Äæ\8e°¼ä¡¦¡¦Âä!¡¦<code><?php echo htmlspecialchars($bshortname)?>.php</code> ¡¦¡¦¡ä¡¦¡¦#Êä"¡ã£âáã¡¦£òä½Øå¡¦¡¦Òä"¡¦/a></li>
3356                         <li><a href="#skins">é«ÐåY¡¦¡åçö¹æ¡¦: ¡¦¾å×äãï^¡¦¡¦¡÷¡¦¡¦¡ä¡¦¶ä"¹ã£ç¥ã³ã¡æ¡¦°ã¡÷¡¦§Øeblog¡¦ÄåPÊç6¶ä!Êä!Öä"¶ä!Þä"¢ä!¡¦¡¦è¿°ã£ò¡¦ ¡¦°ä"¡¦/a></li>
3357                 </ol>
3358
3359                 <h3><a id="index_php">åô¹æ¡¦ 1: <code><?php echo htmlspecialchars($bshortname)?>.php</code> ¡¦¡¦¡ä¡¦¡¦#Êä"¡ã£âáã¡¦£òä½Øå¡¦</a></h3>
3360
3361                 <p><code><?php echo htmlspecialchars($bshortname)?>.php</code> ¡¦¡¦¡ä¡¦¡¦#Êä"¡ã£âáã¡¦£òä½Øå¡¦¡¦Îä!¡¦\80¢ä\8e¶èº«¡¦¡¦»¥ä¸¶ä!¡¦£ê¥ã¼ã¥é¡¦Äæ\8e°¼ã£êä»Ðä!Âä"¡¦</p>
3362 <pre><code>&lt;?php
3363
3364 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';
3365
3366 include('<i>./config.php</i>');
3367
3368 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');
3369 selector();
3370
3371 ?&gt;</code></pre>
3372
3373                 <p>¡¦Òä!§ã¡æ¥á¤ä"¡¦code>index.php</code>¡¦¡¦¿ì¡¦Ðä#¡¦"£ã¥æáâ¡¦¥è¡¦¡¦¡æ¥â¢ã¥ã¡¦Îä#ã¥îáã²ä!Îä!¾ã¡ù¡¦¡¦/p>
3374
3375                 <p>åô°ã¡÷¡¦§Øeblog¡¦¡¦¡¦åæÀä"ÄåM¸ä\8e¸¡¦!Òä"¶ä!Þä"¢ä!¡¦¡è¥à¢ä\8e¶¶ä!¡¦¡ó¡¦¡¦¥õ¡¦¡ã£âáã¡¦¡çSRL¡¦Äå%¥å³û¡¦Îä!¡¦¡ï¡¦ ¡¦Êä!¡¦ ¡¦(¡¦Òä!§ã¡æô¡¦§ï¡¦Îä!Þå ¤ã¡ä¡¦°ä!£ã¡ãáá¡¦"¶ä!¡¦¡è¡¦Úä!¡¦!¾ã¡ù¡¦¸ä\8e½Úæ\8e¦¼ã¡è¥áÎä!¾ã¡û¡¦¡¦:</p>
3376
3377                 <form action="index.php" method="post"><div>
3378                         <input type="hidden" name="action" value="addnewlog2" />
3379                         <?php $manager->addTicketHidden() ?>
3380                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3381                         <table><tr>
3382                                 <td><?php echo _EBLOG_URL?></td>
3383                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3384                         </tr><tr>
3385                                 <td><?php echo _EBLOG_CREATE?></td>
3386                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3387                         </tr></table>
3388                 </div></form>
3389
3390                 <h3><a id="skins">åô¹æ¡¦ 2: ¡¦¾å×äãï^¡¦¡¦¡÷¡¦¡¦¡ä¡¦¶ä"¹ã£ç¥ã³ã¡æ¡¦°ã¡÷¡¦§Øeblog¡¦ÄåPÊç6¶ä!Òä"¶æ\8e¦Ðæ\8e½°ã£ò¡¦ ¡¦°ä"¡¦/a></h3>
3391
3392                 <p>åô°ã¡÷¡¦§Øeblog¡¦¡¦¡¦åæÀä"ÄåM¸ä\8e¸¡¦!Òä"¶ä!Þä"¢ä!¡¦¡è¥à¢ä\8e¶¶ä!¡¦RL¡¦Äå%¥å³û¡¦Îä!¡¦¡ï¡¦ ¡¦Êä!¡¦ ¡¦(å¤§æ³ë¥á¡¦Íáåç8blog¡¦¡¦¿ì¡¦Ï¶RL)</p>
3393
3394                 <form action="index.php" method="post"><div>
3395                         <input type="hidden" name="action" value="addnewlog2" />
3396                         <?php $manager->addTicketHidden() ?>
3397                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3398                         <table><tr>
3399                                 <td><?php echo _EBLOG_URL?></td>
3400                                 <td><input name="url" maxlength="100" size="40" /></td>
3401                         </tr><tr>
3402                                 <td><?php echo _EBLOG_CREATE?></td>
3403                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3404                         </tr></table>
3405                 </div></form>
3406
3407                 <?php           $this->pagefoot();
3408
3409         }
3410
3411         /**
3412          * @todo document this
3413          */
3414         function action_addnewlog2() {
3415                 global $member, $manager;
3416
3417                 $member->blogAdminRights($blogid) or $this->disallow();
3418
3419                 $burl   = requestVar('url');
3420                 $blogid = intRequestVar('blogid');
3421
3422                 $blog =& $manager->getBlog($blogid);
3423                 $blog->setURL(trim($burl));
3424                 $blog->writeSettings();
3425
3426                 $this->action_overview(_MSG_NEWBLOG);
3427         }
3428
3429         /**
3430          * @todo document this
3431          */
3432         function action_skinieoverview() {
3433                 global $member, $DIR_LIBS, $manager;
3434
3435                 $member->isAdmin() or $this->disallow();
3436
3437                 // load skinie class
3438                 include_once($DIR_LIBS . 'skinie.php');
3439
3440                 $this->pagehead();
3441
3442                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3443
3444         ?>
3445                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3446
3447                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3448                                 <?php                                   global $DIR_SKINS;
3449
3450                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3451
3452                                         if (sizeof($candidates) > 0) {
3453                                                 ?>
3454                                                         <form method="post" action="index.php"><div>
3455                                                                 <input type="hidden" name="action" value="skinieimport" />
3456                                                                 <?php $manager->addTicketHidden() ?>
3457                                                                 <input type="hidden" name="mode" value="file" />
3458                                                                 <select name="skinfile" id="skinie_import_local">
3459                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {
3460                                                                                 $html = htmlspecialchars($skinfile);
3461                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';
3462                                                                         }
3463                                                                 ?>
3464                                                                 </select>
3465                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3466                                                         </div></form>
3467                                                 <?php                                   } else {
3468                                                 echo _SKINIE_NOCANDIDATES;
3469                                         }
3470                                 ?>
3471                                 </p>
3472
3473                                 <p><em><?php echo _OR?></em></p>
3474
3475                                 <form method="post" action="index.php"><p>
3476                                         <?php $manager->addTicketHidden() ?>
3477                                         <input type="hidden" name="action" value="skinieimport" />
3478                                         <input type="hidden" name="mode" value="url" />
3479                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3480                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3481                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3482                                 </p></form>
3483
3484
3485                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3486                 <form method="post" action="index.php"><div>
3487                         <input type="hidden" name="action" value="skinieexport" />
3488                         <?php $manager->addTicketHidden() ?>
3489
3490                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3491
3492                         <table><tr>
3493                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3494                         </tr><tr>
3495         <?php           // show list of skins
3496                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3497                 while ($skinObj = mysql_fetch_object($res)) {
3498                         $id = 'skinexp' . $skinObj->sdnumber;
3499                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3500                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';
3501                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';
3502                         echo '</tr><tr>';
3503                 }
3504
3505                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3506
3507                 // show list of templates
3508                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3509                 while ($templateObj = mysql_fetch_object($res)) {
3510                         $id = 'templateexp' . $templateObj->tdnumber;
3511                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3512                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';
3513                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';
3514                         echo '</tr><tr>';
3515                 }
3516
3517         ?>
3518                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3519                         </tr><tr>
3520                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3521                         </tr><tr>
3522                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3523                         </tr><tr>
3524                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3525                         </tr></table>
3526                 </div></form>
3527
3528         <?php
3529                 $this->pagefoot();
3530
3531         }
3532
3533         /**
3534          * @todo document this
3535          */
3536         function action_skinieimport() {
3537                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3538
3539                 $member->isAdmin() or $this->disallow();
3540
3541                 // load skinie class
3542                 include_once($DIR_LIBS . 'skinie.php');
3543
3544                 $skinFileRaw= postVar('skinfile');
3545                 $mode           = postVar('mode');
3546
3547                 $importer =& new SKINIMPORT();
3548
3549                 // get full filename
3550                 if ($mode == 'file')
3551                 {
3552                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3553
3554                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3555                         if (!file_exists($skinFile))
3556                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3557                 } else {
3558                         $skinFile = $skinFileRaw;
3559                 }
3560
3561                 // read only metadata
3562                 $error = $importer->readFile($skinFile, 1);
3563
3564                 // clashes
3565                 $skinNameClashes = $importer->checkSkinNameClashes();
3566                 $templateNameClashes = $importer->checkTemplateNameClashes();
3567                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3568
3569                 if ($error) $this->error($error);
3570
3571                 $this->pagehead();
3572
3573                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3574                 ?>
3575                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3576
3577                 <ul>
3578                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3579                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3580                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3581                         <?php
3582                                 if ($hasNameClashes)
3583                                 {
3584                         ?>
3585                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3586                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3587                         <?php
3588                                 } // if (hasNameClashes)
3589                         ?>
3590                 </ul>
3591
3592                 <form method="post" action="index.php"><div>
3593                         <input type="hidden" name="action" value="skiniedoimport" />
3594                         <?php $manager->addTicketHidden() ?>
3595                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />
3596                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />
3597                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3598                         <?php
3599                                 if ($hasNameClashes)
3600                                 {
3601                         ?>
3602                         <br />
3603                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3604                         <?php
3605                                 } // if (hasNameClashes)
3606                         ?>
3607                 </div></form>
3608
3609
3610                 <?php
3611                 $this->pagefoot();
3612         }
3613
3614         /**
3615          * @todo document this
3616          */
3617         function action_skiniedoimport() {
3618                 global $member, $DIR_LIBS, $DIR_SKINS;
3619
3620                 $member->isAdmin() or $this->disallow();
3621
3622                 // load skinie class
3623                 include_once($DIR_LIBS . 'skinie.php');
3624
3625                 $skinFileRaw= postVar('skinfile');
3626                 $mode           = postVar('mode');
3627
3628                 $allowOverwrite = intPostVar('overwrite');
3629
3630                 // get full filename
3631                 if ($mode == 'file')
3632                 {
3633                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3634
3635                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3636                         if (!file_exists($skinFile))
3637                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3638
3639                 } else {
3640                         $skinFile = $skinFileRaw;
3641                 }
3642
3643                 $importer =& new SKINIMPORT();
3644
3645                 $error = $importer->readFile($skinFile);
3646
3647                 if ($error)
3648                         $this->error($error);
3649
3650                 $error = $importer->writeToDatabase($allowOverwrite);
3651
3652                 if ($error)
3653                         $this->error($error);
3654
3655                 $this->pagehead();
3656
3657                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3658         ?>
3659                 <h2><?php echo _SKINIE_DONE?></h2>
3660
3661                 <ul>
3662                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3663                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3664                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3665                 </ul>
3666
3667         <?php           $this->pagefoot();
3668
3669         }
3670
3671         /**
3672          * @todo document this
3673          */
3674         function action_skinieexport() {
3675                 global $member, $DIR_LIBS;
3676
3677                 $member->isAdmin() or $this->disallow();
3678
3679                 // load skinie class
3680                 include_once($DIR_LIBS . 'skinie.php');
3681
3682                 $aSkins = requestIntArray('skin');
3683                 $aTemplates = requestIntArray('template');
3684
3685                 if (!is_array($aTemplates)) $aTemplates = array();
3686                 if (!is_array($aSkins)) $aSkins = array();
3687
3688                 $skinList = array_keys($aSkins);
3689                 $templateList = array_keys($aTemplates);
3690
3691                 $info = postVar('info');
3692
3693                 $exporter =& new SKINEXPORT();
3694                 foreach ($skinList as $skinId) {
3695                         $exporter->addSkin($skinId);
3696                 }
3697                 foreach ($templateList as $templateId) {
3698                         $exporter->addTemplate($templateId);
3699                 }
3700                 $exporter->setInfo($info);
3701
3702                 $exporter->export();
3703         }
3704
3705         /**
3706          * @todo document this
3707          */
3708         function action_templateoverview() {
3709                 global $member, $manager;
3710
3711                 $member->isAdmin() or $this->disallow();
3712
3713                 $this->pagehead();
3714
3715                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3716
3717                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3718                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3719
3720                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3721                 $template['content'] = 'templatelist';
3722                 $template['tabindex'] = 10;
3723                 showlist($query,'table',$template);
3724
3725                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3726
3727                 ?>
3728                 <form method="post" action="index.php"><div>
3729
3730                 <input name="action" value="templatenew" type="hidden" />
3731                 <?php $manager->addTicketHidden() ?>
3732                 <table><tr>
3733                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3734                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3735                 </tr><tr>
3736                         <td><?php echo _TEMPLATE_DESC?></td>
3737                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3738                 </tr><tr>
3739                         <td><?php echo _TEMPLATE_CREATE?></td>
3740                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3741                 </tr></table>
3742
3743                 </div></form>
3744
3745                 <?php
3746                 $this->pagefoot();
3747         }
3748
3749         /**
3750          * @todo document this
3751          */
3752         function action_templateedit($msg = '') {
3753                 global $member, $manager;
3754
3755                 $templateid = intRequestVar('templateid');
3756
3757                 $member->isAdmin() or $this->disallow();
3758
3759                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3760                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
3761
3762                 $this->pagehead($extrahead);
3763
3764                 $templatename = TEMPLATE::getNameFromId($templateid);
3765                 $templatedescription = TEMPLATE::getDesc($templateid);
3766                 $template =& $manager->getTemplate($templatename);
3767
3768                 ?>
3769                 <p>
3770                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3771                 </p>
3772
3773                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  htmlspecialchars($templatename); ?>'</h2>
3774
3775                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3776                 ?>
3777
3778                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3779
3780                 <form method="post" action="index.php">
3781                 <div>
3782
3783                 <input type="hidden" name="action" value="templateupdate" />
3784                 <?php $manager->addTicketHidden() ?>
3785                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3786
3787                 <table><tr>
3788                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3789                 </tr><tr>
3790                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3791                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>
3792                 </tr><tr>
3793                         <td><?php echo _TEMPLATE_DESC?></td>
3794                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>
3795                 </tr><tr>
3796                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3797                 </tr><tr>
3798                         <td><?php echo _TEMPLATE_UPDATE?></td>
3799                         <td>
3800                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3801                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3802                         </td>
3803                 </tr><tr>
3804                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3805 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3806         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3807         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3808         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3809         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3810         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3811 ?>
3812                 </tr><tr>
3813                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3814 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3815         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3816         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3817         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3818         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3819         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3820         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3821 ?>
3822                 </tr><tr>
3823                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3824 <?php
3825         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3826 ?>
3827                 </tr><tr>
3828                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3829 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3830 ?>
3831                 </tr><tr>
3832                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3833 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3834         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3835         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3836 ?>
3837                 </tr><tr>
3838                         <th colspan="2"><?php echo _TEMPLATE_BLOGLIST?> <?php help('templatebloglists'); ?></th>
3839 <?php   $this->_templateEditRow($template, _TEMPLATE_BLOGHEADER, 'BLOGLIST_HEADER', '', 160);
3840         $this->_templateEditRow($template, _TEMPLATE_BLOGITEM, 'BLOGLIST_LISTITEM', '', 170);
3841         $this->_templateEditRow($template, _TEMPLATE_BLOGFOOTER, 'BLOGLIST_FOOTER', '', 180);
3842 ?>
3843                 </tr><tr>
3844                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3845 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 160);
3846         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 170);
3847         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 180);
3848 ?>
3849                 </tr><tr>
3850                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3851 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 190);
3852         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 200);
3853         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 210);
3854         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 220);
3855         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 230);
3856 ?>
3857                 </tr><tr>
3858                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3859 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 240);
3860         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 250);
3861         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 260);
3862 ?>
3863                 </tr><tr>
3864                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3865 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',270);
3866         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',280);
3867 ?>
3868                 </tr><tr>
3869                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3870                 </tr><tr>
3871                         <td><?php echo _TEMPLATE_UPDATE?></td>
3872                         <td>
3873                                 <input type="submit" tabindex="290" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3874                                 <input type="reset" tabindex="300" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3875                         </td>
3876                 </tr></table>
3877
3878                 </div>
3879                 </form>
3880                 <?php
3881                 $this->pagefoot();
3882         }
3883
3884         /**
3885          * @todo document this
3886          */
3887         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3888                 static $count = 1;
3889         ?>
3890                 </tr><tr>
3891                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3892                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>
3893         <?php           $count++;
3894         }
3895
3896         /**
3897          * @todo document this
3898          */
3899         function action_templateupdate() {
3900                 global $member;
3901
3902                 $templateid = intRequestVar('templateid');
3903
3904                 $member->isAdmin() or $this->disallow();
3905
3906                 $name = postVar('tname');
3907                 $desc = postVar('tdesc');
3908
3909                 if (!isValidTemplateName($name))
3910                         $this->error(_ERROR_BADTEMPLATENAME);
3911
3912                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3913                         $this->error(_ERROR_DUPTEMPLATENAME);
3914
3915
3916                 $name = addslashes($name);
3917                 $desc = addslashes($desc);
3918
3919                 // 1. Remove all template parts
3920                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3921                 sql_query($query);
3922
3923                 // 2. Update description
3924                 $query =  'UPDATE '.sql_table('template_desc').' SET'
3925                            . " tdname='" . $name . "',"
3926                            . " tddesc='" . $desc . "'"
3927                            . " WHERE tdnumber=" . $templateid;
3928                 sql_query($query);
3929
3930                 // 3. Add non-empty template parts
3931                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3932                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3933                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3934                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3935                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3936                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3937                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3938                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3939                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3940                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3941                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
3942                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
3943                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
3944                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
3945                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
3946                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
3947                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3948                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
3949                 $this->addToTemplate($templateid, 'BLOGLIST_HEADER', postVar('BLOGLIST_HEADER'));
3950                 $this->addToTemplate($templateid, 'BLOGLIST_LISTITEM', postVar('BLOGLIST_LISTITEM'));
3951                 $this->addToTemplate($templateid, 'BLOGLIST_FOOTER', postVar('BLOGLIST_FOOTER'));
3952                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
3953                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
3954                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
3955                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
3956                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
3957                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
3958                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
3959                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
3960                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
3961                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3962                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
3963                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
3964                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
3965
3966
3967                 // jump back to template edit
3968                 $this->action_templateedit(_TEMPLATE_UPDATED);
3969
3970         }
3971
3972         /**
3973          * @todo document this
3974          */
3975         function addToTemplate($id, $partname, $content) {
3976                 $partname = addslashes($partname);
3977                 $content = addslashes($content);
3978
3979                 $id = intval($id);
3980
3981                 // don't add empty parts:
3982                 if (!trim($content)) return -1;
3983
3984                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
3985                            . "VALUES ($id, '$partname', '$content')";
3986                 sql_query($query) or die("Query error: " . mysql_error());
3987                 return mysql_insert_id();
3988         }
3989
3990         /**
3991          * @todo document this
3992          */
3993         function action_templatedelete() {
3994                 global $member, $manager;
3995
3996                 $member->isAdmin() or $this->disallow();
3997
3998                 $templateid = intRequestVar('templateid');
3999                 // TODO: check if template can be deleted
4000
4001                 $this->pagehead();
4002
4003                 $name = TEMPLATE::getNameFromId($templateid);
4004                 $desc = TEMPLATE::getDesc($templateid);
4005
4006                 ?>
4007                         <h2><?php echo _DELETE_CONFIRM?></h2>
4008
4009                         <p>
4010                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo htmlspecialchars($name)?></b> (<?php echo  htmlspecialchars($desc) ?>)
4011                         </p>
4012
4013                         <form method="post" action="index.php"><div>
4014                                 <input type="hidden" name="action" value="templatedeleteconfirm" />
4015                                 <?php $manager->addTicketHidden() ?>
4016                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
4017                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4018                         </div></form>
4019                 <?php
4020                 $this->pagefoot();
4021         }
4022
4023         /**
4024          * @todo document this
4025          */
4026         function action_templatedeleteconfirm() {
4027                 global $member, $manager;
4028
4029                 $templateid = intRequestVar('templateid');
4030
4031                 $member->isAdmin() or $this->disallow();
4032
4033                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
4034
4035                 // 1. delete description
4036                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
4037
4038                 // 2. delete parts
4039                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4040
4041                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
4042
4043                 $this->action_templateoverview();
4044         }
4045
4046         /**
4047          * @todo document this
4048          */
4049         function action_templatenew() {
4050                 global $member;
4051
4052                 $member->isAdmin() or $this->disallow();
4053
4054                 $name = postVar('name');
4055                 $desc = postVar('desc');
4056
4057                 if (!isValidTemplateName($name))
4058                         $this->error(_ERROR_BADTEMPLATENAME);
4059
4060                 if (TEMPLATE::exists($name))
4061                         $this->error(_ERROR_DUPTEMPLATENAME);
4062
4063                 $newTemplateId = TEMPLATE::createNew($name, $desc);
4064
4065                 $this->action_templateoverview();
4066         }
4067
4068         /**
4069          * @todo document this
4070          */
4071         function action_templateclone() {
4072                 global $member;
4073
4074                 $templateid = intRequestVar('templateid');
4075
4076                 $member->isAdmin() or $this->disallow();
4077
4078                 // 1. read old template
4079                 $name = TEMPLATE::getNameFromId($templateid);
4080                 $desc = TEMPLATE::getDesc($templateid);
4081
4082                 // 2. create desc thing
4083                 $name = "cloned" . $name;
4084
4085                 // if a template with that name already exists:
4086                 if (TEMPLATE::exists($name)) {
4087                         $i = 1;
4088                         while (TEMPLATE::exists($name . $i))
4089                                 $i++;
4090                         $name .= $i;
4091                 }
4092
4093                 $newid = TEMPLATE::createNew($name, $desc);
4094
4095                 // 3. create clone
4096                 // go through parts of old template and add them to the new one
4097                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4098                 while ($o = mysql_fetch_object($res)) {
4099                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4100                 }
4101
4102                 $this->action_templateoverview();
4103         }
4104
4105         /**
4106          * @todo document this
4107          */
4108         function action_skinoverview() {
4109                 global $member, $manager;
4110
4111                 $member->isAdmin() or $this->disallow();
4112
4113                 $this->pagehead();
4114
4115                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4116
4117                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4118
4119                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4120
4121                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4122                 $template['content'] = 'skinlist';
4123                 $template['tabindex'] = 10;
4124                 showlist($query,'table',$template);
4125
4126                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4127
4128                 ?>
4129                 <form method="post" action="index.php">
4130                 <div>
4131
4132                 <input name="action" value="skinnew" type="hidden" />
4133                 <?php $manager->addTicketHidden() ?>
4134                 <table><tr>
4135                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4136                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4137                 </tr><tr>
4138                         <td><?php echo _SKIN_DESC?></td>
4139                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4140                 </tr><tr>
4141                         <td><?php echo _SKIN_CREATE?></td>
4142                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4143                 </tr></table>
4144
4145                 </div>
4146                 </form>
4147
4148                 <?php
4149                 $this->pagefoot();
4150         }
4151
4152         /**
4153          * @todo document this
4154          */
4155         function action_skinnew() {
4156                 global $member;
4157
4158                 $member->isAdmin() or $this->disallow();
4159
4160                 $name = trim(postVar('name'));
4161                 $desc = trim(postVar('desc'));
4162
4163                 if (!isValidSkinName($name))
4164                         $this->error(_ERROR_BADSKINNAME);
4165
4166                 if (SKIN::exists($name))
4167                         $this->error(_ERROR_DUPSKINNAME);
4168
4169                 $newId = SKIN::createNew($name, $desc);
4170
4171                 $this->action_skinoverview();
4172         }
4173
4174         /**
4175          * @todo document this
4176          */
4177         function action_skinedit() {
4178                 global $member, $manager;
4179
4180                 $skinid = intRequestVar('skinid');
4181
4182                 $member->isAdmin() or $this->disallow();
4183
4184                 $skin =& new SKIN($skinid);
4185
4186                 $this->pagehead();
4187                 ?>
4188                 <p>
4189                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4190                 </p>
4191                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4192
4193                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4194                 <?php echo _SKIN_PARTS_MSG?>
4195                 <ul>
4196                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4197                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4198                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4199                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4200                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4201                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4202                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4203                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4204                 </ul>
4205
4206                 <?php
4207
4208                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4209                 $res = sql_query($query);
4210
4211                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4212                 echo '<form method="get" action="index.php">' . "\r\n";
4213                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4214                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4215                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4216                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4217                 echo '</form>' . "\r\n";
4218
4219                 if ($res && mysql_num_rows($res) > 0) {
4220                         echo '<ul>';
4221                         $tabstart = 75;
4222
4223                         while ($row = mysql_fetch_assoc($res)) {
4224                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">' . htmlspecialchars(ucfirst($row['stype'])) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . htmlspecialchars(strtolower($row['stype'])) . '">remove</a>)</li>';
4225                         }
4226
4227                         echo '</ul>';
4228                 }
4229
4230                 ?>
4231
4232                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4233                 <form method="post" action="index.php">
4234                 <div>
4235
4236                 <input type="hidden" name="action" value="skineditgeneral" />
4237                 <?php $manager->addTicketHidden() ?>
4238                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4239                 <table><tr>
4240                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4241                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>
4242                 </tr><tr>
4243                         <td><?php echo _SKIN_DESC?></td>
4244                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4245                 </tr><tr>
4246                         <td><?php echo _SKIN_TYPE?></td>
4247                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4248                 </tr><tr>
4249                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4250                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4251                 </tr><tr>
4252                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4253                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4254                 </tr><tr>
4255                         <td><?php echo _SKIN_CHANGE?></td>
4256                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4257                 </tr></table>
4258
4259                 </div>
4260                 </form>
4261
4262
4263                 <?php           $this->pagefoot();
4264         }
4265
4266         /**
4267          * @todo document this
4268          */
4269         function action_skineditgeneral() {
4270                 global $member;
4271
4272                 $skinid = intRequestVar('skinid');
4273
4274                 $member->isAdmin() or $this->disallow();
4275
4276                 $name = postVar('name');
4277                 $desc = postVar('desc');
4278                 $type = postVar('type');
4279                 $inc_mode = postVar('inc_mode');
4280                 $inc_prefix = postVar('inc_prefix');
4281
4282                 $skin =& new SKIN($skinid);
4283
4284                 // 1. Some checks
4285                 if (!isValidSkinName($name))
4286                         $this->error(_ERROR_BADSKINNAME);
4287
4288                 if (($skin->getName() != $name) && SKIN::exists($name))
4289                         $this->error(_ERROR_DUPSKINNAME);
4290
4291                 if (!$type) $type = 'text/html';
4292                 if (!$inc_mode) $inc_mode = 'normal';
4293
4294                 // 2. Update description
4295                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4296
4297                 $this->action_skinedit();
4298
4299         }
4300
4301         /**
4302          * @todo document this
4303          */
4304         function action_skinedittype($msg = '') {
4305                 global $member, $manager;
4306
4307                 $skinid = intRequestVar('skinid');
4308                 $type = requestVar('type');
4309
4310                 $member->isAdmin() or $this->disallow();
4311
4312                 $type = trim($type);
4313                 $type = strtolower($type);
4314
4315                 if (!isValidShortName($type)) {
4316                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4317                 }
4318
4319                 $skin =& new SKIN($skinid);
4320
4321                 $friendlyNames = SKIN::getFriendlyNames();
4322
4323                 $this->pagehead();
4324                 ?>
4325                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4326
4327                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo htmlspecialchars($skin->getName()) ?>': <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4328
4329                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4330                 ?>
4331
4332
4333                 <form method="post" action="index.php">
4334                 <div>
4335
4336                 <input type="hidden" name="action" value="skinupdate" />
4337                 <?php $manager->addTicketHidden() ?>
4338                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4339                 <input type="hidden" name="type" value="<?php echo  $type ?>" />
4340
4341                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4342                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4343                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4344                 <?php if (in_array($type, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4345                         help('skinpart' . $type);
4346                 } else {
4347                         help('skinpartspecial');
4348                 }?>
4349                 <br />
4350
4351                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>
4352
4353                 <br />
4354                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4355                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4356                 (skin type: <?php echo htmlspecialchars(isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4357
4358                 <br /><br />
4359                 <?php echo _SKIN_ALLOWEDVARS?>
4360                 <?php                   $actions = SKIN::getAllowedActionsForType($type);
4361
4362                         sort($actions);
4363
4364                         while ($current = array_shift($actions)) {
4365                                 // skip deprecated vars
4366                                 if ($current == 'ifcat') continue;
4367                                 if ($current == 'imagetext') continue;
4368                                 if ($current == 'vars') continue;
4369
4370                                 echo helplink('skinvar-' . $current) . "$current</a>";
4371                                 if (count($actions) != 0) echo ", ";
4372                         }
4373                 ?>
4374                 <br /><br />
4375                 Short blog names:
4376                 <?php                   $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4377                         showlist($query,'table',array('content'=>'shortblognames'));
4378                 ?>
4379
4380                 <br />
4381                 Template names:
4382                 <?php                   $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4383                         showlist($query,'table',array('content'=>'shortnames'));
4384                 ?>
4385
4386
4387                 </div>
4388                 </form>
4389
4390
4391                 <?php           $this->pagefoot();
4392         }
4393
4394         /**
4395          * @todo document this
4396          */
4397         function action_skinupdate() {
4398                 global $member;
4399
4400                 $skinid = intRequestVar('skinid');
4401                 $content = trim(postVar('content'));
4402                 $type = postVar('type');
4403
4404                 $member->isAdmin() or $this->disallow();
4405
4406                 $skin =& new SKIN($skinid);
4407                 $skin->update($type, $content);
4408
4409                 $this->action_skinedittype(_SKIN_UPDATED);
4410         }
4411
4412         /**
4413          * @todo document this
4414          */
4415         function action_skindelete() {
4416                 global $member, $manager, $CONF;
4417
4418                 $skinid = intRequestVar('skinid');
4419
4420                 $member->isAdmin() or $this->disallow();
4421
4422                 // don't allow default skin to be deleted
4423                 if ($skinid == $CONF['BaseSkin'])
4424                         $this->error(_ERROR_DEFAULTSKIN);
4425
4426                 // don't allow deletion of default skins for blogs
4427                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4428                 $r = sql_query($query);
4429                 if ($o = mysql_fetch_object($r))
4430                         $this->error(_ERROR_SKINDEFDELETE . htmlspecialchars($o->bname));
4431
4432                 $this->pagehead();
4433
4434                 $skin =& new SKIN($skinid);
4435                 $name = $skin->getName();
4436                 $desc = $skin->getDescription();
4437
4438                 ?>
4439                         <h2><?php echo _DELETE_CONFIRM?></h2>
4440
4441                         <p>
4442                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo htmlspecialchars($name) ?></b> (<?php echo  htmlspecialchars($desc)?>)
4443                         </p>
4444
4445                         <form method="post" action="index.php"><div>
4446                                 <input type="hidden" name="action" value="skindeleteconfirm" />
4447                                 <?php $manager->addTicketHidden() ?>
4448                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4449                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4450                         </div></form>
4451                 <?php
4452                 $this->pagefoot();
4453         }
4454
4455         /**
4456          * @todo document this
4457          */
4458         function action_skindeleteconfirm() {
4459                 global $member, $CONF, $manager;
4460
4461                 $skinid = intRequestVar('skinid');
4462
4463                 $member->isAdmin() or $this->disallow();
4464
4465                 // don't allow default skin to be deleted
4466                 if ($skinid == $CONF['BaseSkin'])
4467                         $this->error(_ERROR_DEFAULTSKIN);
4468
4469                 // don't allow deletion of default skins for blogs
4470                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4471                 $r = sql_query($query);
4472                 if ($o = mysql_fetch_object($r))
4473                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4474
4475                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4476
4477                 // 1. delete description
4478                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4479
4480                 // 2. delete parts
4481                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4482
4483                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4484
4485                 $this->action_skinoverview();
4486         }
4487
4488         /**
4489          * @todo document this
4490          */
4491         function action_skinremovetype() {
4492                 global $member, $manager, $CONF;
4493
4494                 $skinid = intRequestVar('skinid');
4495                 $skintype = requestVar('type');
4496
4497                 if (!isValidShortName($skintype)) {
4498                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4499                 }
4500
4501                 $member->isAdmin() or $this->disallow();
4502
4503                 // don't allow default skinparts to be deleted
4504                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4505                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4506                 }
4507
4508                 $this->pagehead();
4509
4510                 $skin =& new SKIN($skinid);
4511                 $name = $skin->getName();
4512                 $desc = $skin->getDescription();
4513
4514                 ?>
4515                         <h2><?php echo _DELETE_CONFIRM?></h2>
4516
4517                         <p>
4518                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo htmlspecialchars($skintype); ?> (<?php echo htmlspecialchars($name); ?>)</b> (<?php echo  htmlspecialchars($desc)?>)
4519                         </p>
4520
4521                         <form method="post" action="index.php"><div>
4522                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4523                                 <?php $manager->addTicketHidden() ?>
4524                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4525                                 <input type="hidden" name="type" value="<?php echo htmlspecialchars($skintype); ?>" />
4526                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4527                         </div></form>
4528                 <?php
4529                 $this->pagefoot();
4530         }
4531
4532         /**
4533          * @todo document this
4534          */
4535         function action_skinremovetypeconfirm() {
4536                 global $member, $CONF, $manager;
4537
4538                 $skinid = intRequestVar('skinid');
4539                 $skintype = requestVar('type');
4540
4541                 if (!isValidShortName($skintype)) {
4542                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4543                 }
4544
4545                 $member->isAdmin() or $this->disallow();
4546
4547                 // don't allow default skinparts to be deleted
4548                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4549                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4550                 }
4551
4552                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4553
4554                 // delete part
4555                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4556
4557                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4558
4559                 $this->action_skinedit();
4560         }
4561
4562         /**
4563          * @todo document this
4564          */
4565         function action_skinclone() {
4566                 global $member;
4567
4568                 $skinid = intRequestVar('skinid');
4569
4570                 $member->isAdmin() or $this->disallow();
4571
4572                 // 1. read skin to clone
4573                 $skin =& new SKIN($skinid);
4574
4575                 $name = "clone_" . $skin->getName();
4576
4577                 // if a skin with that name already exists:
4578                 if (SKIN::exists($name)) {
4579                         $i = 1;
4580                         while (SKIN::exists($name . $i))
4581                                 $i++;
4582                         $name .= $i;
4583                 }
4584
4585                 // 2. create skin desc
4586                 $newid = SKIN::createNew(
4587                         $name,
4588                         $skin->getDescription(),
4589                         $skin->getContentType(),
4590                         $skin->getIncludeMode(),
4591                         $skin->getIncludePrefix()
4592                 );
4593
4594
4595                 // 3. clone
4596                 /*
4597                 $this->skinclonetype($skin, $newid, 'index');
4598                 $this->skinclonetype($skin, $newid, 'item');
4599                 $this->skinclonetype($skin, $newid, 'archivelist');
4600                 $this->skinclonetype($skin, $newid, 'archive');
4601                 $this->skinclonetype($skin, $newid, 'search');
4602                 $this->skinclonetype($skin, $newid, 'error');
4603                 $this->skinclonetype($skin, $newid, 'member');
4604                 $this->skinclonetype($skin, $newid, 'imagepopup');
4605                 */
4606
4607                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE sdesc = " . $skinid;
4608                 $res = sql_query($query);
4609                 while ($row = mysql_fetch_assoc($res)) {
4610                         $this->skinclonetype($skin, $newid, $row['stype']);
4611                 }
4612
4613                 $this->action_skinoverview();
4614
4615         }
4616
4617         /**
4618          * @todo document this
4619          */
4620         function skinclonetype($skin, $newid, $type) {
4621                 $newid = intval($newid);
4622                 $content = $skin->getContent($type);
4623                 if ($content) {
4624                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
4625                         sql_query($query);
4626                 }
4627         }
4628
4629         /**
4630          * @todo document this
4631          */
4632         function action_settingsedit() {
4633                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4634
4635                 $member->isAdmin() or $this->disallow();
4636
4637                 $this->pagehead();
4638
4639                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4640                 ?>
4641
4642                 <h2><?php echo _SETTINGS_TITLE?></h2>
4643
4644                 <form action="index.php" method="post">
4645                 <div>
4646
4647                 <input type="hidden" name="action" value="settingsupdate" />
4648                 <?php $manager->addTicketHidden() ?>
4649
4650                 <table><tr>
4651                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4652                 </tr><tr>
4653                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4654                         <td>
4655                                 <?php
4656                                         $query =  'SELECT bname as text, bnumber as value'
4657                                                    . ' FROM '.sql_table('blog');
4658                                         $template['name'] = 'DefaultBlog';
4659                                         $template['selected'] = $CONF['DefaultBlog'];
4660                                         $template['tabindex'] = 10;
4661                                         showlist($query,'select',$template);
4662                                 ?>
4663                         </td>
4664                 </tr><tr>
4665                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4666                         <td>
4667                                 <?php
4668                                         $query =  'SELECT sdname as text, sdnumber as value'
4669                                                    . ' FROM '.sql_table('skin_desc');
4670                                         $template['name'] = 'BaseSkin';
4671                                         $template['selected'] = $CONF['BaseSkin'];
4672                                         $template['tabindex'] = 1;
4673                                         showlist($query,'select',$template);
4674                                 ?>
4675                         </td>
4676                 </tr><tr>
4677                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4678                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>
4679                 </tr><tr>
4680                         <td><?php echo _SETTINGS_SITENAME?></td>
4681                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>
4682                 </tr><tr>
4683                         <td><?php echo _SETTINGS_SITEURL?></td>
4684                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>
4685                 </tr><tr>
4686                         <td><?php echo _SETTINGS_ADMINURL?></td>
4687                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>
4688                 </tr><tr>
4689                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4690                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>
4691                 </tr><tr>
4692                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4693                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>
4694                 </tr><tr>
4695                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4696                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>
4697                 </tr><tr>
4698                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4699                         </td>
4700                         <td>
4701
4702                                 <select name="Language" tabindex="10050">
4703                                 <?php                           // show a dropdown list of all available languages
4704                                 global $DIR_LANG;
4705                                 $dirhandle = opendir($DIR_LANG);
4706                                 while ($filename = readdir($dirhandle)) {
4707                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
4708                                                 $name = $matches[1];
4709                                                 echo "<option value='$name'";
4710                                                 if ($name == $CONF['Language'])
4711                                                         echo " selected='selected'";
4712                                                 echo ">$name</option>";
4713                                         }
4714                                 }
4715                                 closedir($dirhandle);
4716
4717                                 ?>
4718                                 </select>
4719
4720                         </td>
4721                 </tr><tr>
4722                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4723                         </td>
4724                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4725                                         <br />
4726                                 URL: <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />
4727                         </td>
4728                 </tr><tr>
4729                         <td><?php echo _SETTINGS_DIRS?></td>
4730                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>
4731                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4732                 </tr><tr>
4733                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4734                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4735                 </tr><tr>
4736                         <td>
4737                         <?php
4738                                 echo _SETTINGS_JSTOOLBAR
4739                                 /* =_SETTINGS_DISABLEJS
4740
4741                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4742                                         way to select the javascript version to use
4743
4744                                         now, its:
4745                                                 0 : IE
4746                                                 1 : all javascript disabled
4747                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4748                                 */
4749                            ?>
4750                         </td>
4751                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4752                                 <select name="DisableJsTools" tabindex="10075">
4753                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4754                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4755                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4756                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4757                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4758                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4759                         ?>
4760                                 </select>
4761                         </td>
4762                 </tr><tr>
4763                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4764                                            <td><?php
4765
4766                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4767                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4768
4769                                            echo ' ', _SETTINGS_URLMODE_HELP;
4770
4771                                                          ?>
4772
4773                                            </td>
4774                 </tr><tr>
4775                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4776                 </tr><tr>
4777                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4778                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>
4779                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4780                                 <?php                           if (!is_dir($DIR_MEDIA))
4781                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4782                                         if (!is_readable($DIR_MEDIA))
4783                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4784                                         if (!is_writeable($DIR_MEDIA))
4785                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4786                                 ?>
4787                         </td>
4788                 </tr><tr>
4789                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4790                         <td>
4791                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />
4792                         </td>
4793                 </tr><tr>
4794                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4795                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4796                 </tr><tr>
4797                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4798                         <td>
4799                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />
4800                         </td>
4801                 </tr><tr>
4802                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4803                         <td>
4804                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />
4805                         </td>
4806                 </tr><tr>
4807                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4808                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4809
4810                 </tr><tr>
4811                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4812                 </tr><tr>
4813                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4814                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4815                 </tr><tr>
4816                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4817                                 <?php help('allowaccountcreation'); ?>
4818                         </td>
4819                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4820                         </td>
4821                 </tr><tr>
4822                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4823                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4824                         </td>
4825                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4826                         </td>
4827                 </tr><tr>
4828                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4829                                 <?php help('messageservice'); ?>
4830                         </td>
4831                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4832                         </td>
4833                 </tr><tr>
4834                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4835                                 <?php help('messageservice'); ?>
4836                         </td>
4837                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4838                         </td>
4839                 </tr><tr>
4840                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4841                                 <?php help('protectmemnames'); ?>
4842                         </td>
4843                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4844                         </td>
4845
4846
4847
4848                 </tr><tr>
4849                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4850                 </tr><tr>
4851                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4852                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>
4853                 </tr><tr>
4854                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4855                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>
4856                 </tr><tr>
4857                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
4858                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>
4859                 </tr><tr>
4860                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
4861                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4862                 </tr><tr>
4863                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
4864                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4865                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4866                         </td>
4867                 </tr><tr>
4868                         <td><?php echo _SETTINGS_LASTVISIT?></td>
4869                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4870
4871
4872
4873                 </tr><tr>
4874                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
4875                 </tr><tr>
4876                         <td><?php echo _SETTINGS_UPDATE?></td>
4877                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
4878                 </tr></table>
4879
4880                 </div>
4881                 </form>
4882
4883                 <?php
4884                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
4885
4886                         $manager->notify(
4887                                 'GeneralSettingsFormExtras',
4888                                 array()
4889                         );
4890
4891                 $this->pagefoot();
4892         }
4893
4894         /**
4895          * @todo document this
4896          */
4897         function action_settingsupdate() {
4898                 global $member, $CONF;
4899
4900                 $member->isAdmin() or $this->disallow();
4901
4902                 // check if email address for admin is valid
4903                 if (!isValidMailAddress(postVar('AdminEmail')))
4904                         $this->error(_ERROR_BADMAILADDRESS);
4905
4906
4907                 // save settings
4908                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));
4909                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));
4910                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));
4911                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));
4912                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
4913                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));
4914                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
4915                 $this->updateConfig('Language',                 postVar('Language'));
4916                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));
4917                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
4918                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
4919                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
4920                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
4921                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
4922                 $this->updateConfig('SiteName',                 postVar('SiteName'));
4923                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
4924                 $this->updateConfig('DisableSite',              postVar('DisableSite'));
4925                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
4926                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
4927                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));
4928                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));
4929                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));
4930                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
4931                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));
4932                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
4933                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
4934                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));
4935                 $this->updateConfig('CookiePath',               postVar('CookiePath'));
4936                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));
4937                 $this->updateConfig('URLMode',                  postVar('URLMode'));
4938                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));
4939
4940                 // load new config and redirect (this way, the new language will be used is necessary)
4941                 // note that when changing cookie settings, this redirect might cause the user
4942                 // to have to log in again.
4943                 getConfig();
4944                 redirect($CONF['AdminURL'] . '?action=manage');
4945                 exit;
4946
4947         }
4948
4949         /**
4950          * @todo document this
4951          */
4952         function updateConfig($name, $val) {
4953                 $name = addslashes($name);
4954                 $val = trim(addslashes($val));
4955
4956                 $query = 'UPDATE '.sql_table('config')
4957                            . " SET value='$val'"
4958                            . " WHERE name='$name'";
4959
4960                 sql_query($query) or die("Query error: " . mysql_error());
4961                 return mysql_insert_id();
4962         }
4963
4964         /**
4965          * Error message
4966          * @param string $msg message that will be shown
4967          */
4968         function error($msg) {
4969                 $this->pagehead();
4970                 ?>
4971                 <h2>Error!</h2>
4972                 <?php           echo $msg;
4973                 echo "<br />";
4974                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
4975                 $this->pagefoot();
4976                 exit;
4977         }
4978
4979         /**
4980          * @todo document this
4981          */
4982         function disallow() {
4983                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4984
4985                 $this->error(_ERROR_DISALLOWED);
4986         }
4987
4988         /**
4989          * @todo document this
4990          */
4991         function pagehead($extrahead = '') {
4992                 global $member, $nucleus, $CONF, $manager;
4993
4994                 $manager->notify(
4995                         'AdminPrePageHead',
4996                         array(
4997                                 'extrahead' => &$extrahead,
4998                                 'action' => $this->action
4999                         )
5000                 );
5001
5002                 $baseUrl = htmlspecialchars($CONF['AdminURL']);
5003
5004                 ?>
5005                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
5006                 <html xmlns="http://www.w3.org/1999/xhtml">
5007                 <head>
5008                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />
5009                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>
5010                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />
5011                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
5012                         href="<?php echo $baseUrl?>styles/addedit.css" />
5013
5014                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
5015                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
5016                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
5017
5018           <meta http-equiv='Pragma' content='no-cache' />
5019           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
5020           <meta http-equiv='Expires' content='-1' />
5021
5022                         <?php echo $extrahead?>
5023                 </head>
5024                 <body>
5025                 <div class="header">
5026                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>
5027                 </div>
5028                 <div id="container">
5029                 <div id="content">
5030                 <div class="loginname">
5031                 <?php                   if ($member->isLoggedIn())
5032                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
5033                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
5034                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
5035                         else
5036                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
5037
5038                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
5039
5040                         echo '<br />(';
5041
5042                         // Note(JP): disabled code name description
5043 /*
5044                         if ($member->isLoggedIn() && $member->isAdmin())
5045                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;</a>';
5046                         else
5047                                 echo 'Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;';
5048 */
5049                         if ($member->isLoggedIn() && $member->isAdmin())
5050                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' </a>';
5051                         else
5052                                 echo 'Nucleus CMS ', $nucleus['version'];
5053                         echo ')';
5054                 echo '</div>';
5055         }
5056
5057         /**
5058          * @todo document this
5059          */
5060         function pagefoot() {
5061                 global $action, $member, $manager;
5062
5063                 $manager->notify(
5064                         'AdminPrePageFoot',
5065                         array(
5066                                 'action' => $this->action
5067                         )
5068                 );
5069
5070                 if ($member->isLoggedIn() && ($action != 'showlogin')) {
5071                         ?>
5072                         <h2><?php echo  _LOGOUT ?></h2>
5073                         <ul>
5074                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5075                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5076                         </ul>
5077                         <?php           }
5078                 ?>
5079                         <div class="foot">
5080                                 <a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-<?php echo date('Y'); ?> The Nucleus Group
5081                                 -
5082                                 <a href="http://nucleuscms.org/donate.php">Donate!</a>
5083                         </div>
5084
5085                         </div><!-- content -->
5086
5087                         <div id="quickmenu">
5088
5089                                 <?php                           // ---- user settings ----
5090                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5091                                         echo '<ul>';
5092                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5093                                         echo '</ul>';
5094
5095                                         echo '<h2>',_QMENU_ADD,'</h2>';
5096                                         echo '<form method="get" action="index.php"><div>';
5097                                         echo '<input type="hidden" name="action" value="createitem" />';
5098
5099                                                 $showAll = requestVar('showall');
5100                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {
5101                                                         // Super-Admins have access to all blogs! (no add item support though)
5102                                                         $query =  'SELECT bnumber as value, bname as text'
5103                                                                    . ' FROM ' . sql_table('blog')
5104                                                                    . ' ORDER BY bname';
5105                                                 } else {
5106                                                         $query =  'SELECT bnumber as value, bname as text'
5107                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5108                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5109                                                                    . ' ORDER BY bname';
5110                                                 }
5111                                                 $template['name'] = 'blogid';
5112                                                 $template['tabindex'] = 15000;
5113                                                 $template['extra'] = _QMENU_ADD_SELECT;
5114                                                 $template['selected'] = -1;
5115                                                 $template['shorten'] = 10;
5116                                                 $template['shortenel'] = '';
5117                                                 $template['javascript'] = 'onchange="return form.submit()"';
5118                                                 showlist($query,'select',$template);
5119
5120                                         echo '</div></form>';
5121
5122                                         echo '<h2>' . $member->getDisplayName(). '</h2>';
5123                                         echo '<ul>';
5124                                         echo '<li><a href="index.php?action=editmembersettings">',_QMENU_USER_SETTINGS,'</a></li>';
5125                                         echo '<li><a href="index.php?action=browseownitems">',_QMENU_USER_ITEMS,'</a></li>';
5126                                         echo '<li><a href="index.php?action=browseowncomments">',_QMENU_USER_COMMENTS,'</a></li>';
5127                                         echo '</ul>';
5128
5129
5130
5131
5132                                         // ---- general settings ----
5133                                         if ($member->isAdmin()) {
5134
5135                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';
5136
5137                                                 echo '<ul>';
5138                                                 echo '<li><a href="index.php?action=actionlog">',_QMENU_MANAGE_LOG,'</a></li>';
5139                                                 echo '<li><a href="index.php?action=settingsedit">',_QMENU_MANAGE_SETTINGS,'</a></li>';
5140                                                 echo '<li><a href="index.php?action=usermanagement">',_QMENU_MANAGE_MEMBERS,'</a></li>';
5141                                                 echo '<li><a href="index.php?action=createnewlog">',_QMENU_MANAGE_NEWBLOG,'</a></li>';
5142                                                 echo '<li><a href="index.php?action=backupoverview">',_QMENU_MANAGE_BACKUPS,'</a></li>';
5143                                                 echo '<li><a href="index.php?action=pluginlist">',_QMENU_MANAGE_PLUGINS,'</a></li>';
5144                                                 echo '</ul>';
5145
5146                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';
5147                                                 echo '<ul>';
5148                                                 echo '<li><a href="index.php?action=skinoverview">',_QMENU_LAYOUT_SKINS,'</a></li>';
5149                                                 echo '<li><a href="index.php?action=templateoverview">',_QMENU_LAYOUT_TEMPL,'</a></li>';
5150                                                 echo '<li><a href="index.php?action=skinieoverview">',_QMENU_LAYOUT_IEXPORT,'</a></li>';
5151                                                 echo '</ul>';
5152
5153                                         }
5154
5155                                         $aPluginExtras = array();
5156                                         $manager->notify(
5157                                                 'QuickMenu',
5158                                                 array(
5159                                                         'options' => &$aPluginExtras
5160                                                 )
5161                                         );
5162                                         if (count($aPluginExtras) > 0)
5163                                         {
5164                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';
5165                                                 echo '<ul>';
5166                                                 foreach ($aPluginExtras as $aInfo)
5167                                                 {
5168                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';
5169                                                 }
5170                                                 echo '</ul>';
5171                                         }
5172
5173                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5174
5175                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5176                                 } else {
5177                                         // introduction text on login screen
5178                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5179                                 }
5180                                 ?>
5181                         </div>
5182
5183                         <!-- content / quickmenu container -->
5184                         </div>
5185
5186
5187                         </body>
5188                         </html>
5189                 <?php   }
5190
5191         /**
5192          * @todo document this
5193          */
5194         function action_regfile() {
5195                 global $member, $CONF;
5196
5197                 $blogid = intRequestVar('blogid');
5198
5199                 $member->teamRights($blogid) or $this->disallow();
5200
5201                 // header-code stolen from phpMyAdmin
5202                 // REGEDIT and bookmarklet code stolen from GreyMatter
5203
5204                 $sjisBlogName = getBlogNameFromID($blogid);
5205                 $sjisBlogName = mb_convert_encoding($sjisBlogName, "SJIS", "auto");
5206
5207                 header('Content-Type: application/octetstream');
5208                 header('Content-Disposition: filename="nucleus.reg"');
5209                 header('Pragma: no-cache');
5210                 header('Expires: 0');
5211
5212                 echo "REGEDIT4\n";
5213                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\Post To &Nucleus (".$sjisBlogName.")]\n";
5214                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5215                 echo '"contexts"=hex:31';
5216         }
5217
5218         /**
5219          * @todo document this
5220          */
5221         function action_bookmarklet() {
5222                 global $member, $manager;
5223
5224                 $blogid = intRequestVar('blogid');
5225
5226                 $member->teamRights($blogid) or $this->disallow();
5227
5228                 $blog =& $manager->getBlog($blogid);
5229                 $bm = getBookmarklet($blogid);
5230
5231                 $this->pagehead();
5232
5233                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5234
5235                 ?>
5236
5237                 <h2>Bookmarklet<!-- and Right Click Menu --></h2>
5238
5239                 <p>
5240                 Bookmarklet ¡¦¡¦¡è¥à¢ä"¡¦¥åáã¡¦"°Ó¡¦Üä!§è¡¦äº¶ä!¡¦³õç¨¿ã¡ì¡¦§ã¡í¡¦¶ä"·ã£í¥ã¡¦# ¡¦§ã¡ù¡¦¡¦¡¦Æä!¡¦Bookmarklet ¡¦Ää"¤ã¥ê¥â¹ã¥è¡¦¼ã¥æ¥áÒä"¶ä!¡¦\80¢ä#Ìä#¡¦£ãáâ¶ã¡çáã¡¦#¼ã¥æ¥ãÀä#¼ã¡ç%add to weblog'¡¦Øä"¿ã¥ê¥á¸å(¡¦Çäåï¡¦¥ï¥á¡¦¡åáâ´ä ¡¯ucleus¡¦¡¦Ëèëãºä"¢ã£âáã¡¦# ¡¦¡¦¿½¡¦ ¡¦¡¦£â¥ã³ã¥é¡¦¡¦¡ì¡¦Úä#¡¦#Îä"¢ã¥ã¡¦Îä!Îä!¾ã¡ù¡¦¤ä\8e¹»æ§ï¡¦¶eb¡¦Ôä#¼ã£ìáâÄç6¶ä!¡¦!Þæ*¶æ¡¦¡¦§ã¡ó¡¦¡¦¡¦¡¦¿ã¥ê¥âÄå¡¦ááÖä!°ã\80¢ä!Úä!¶eb¡¦Ôä#¼ã£ìáá¡¦£ð¥â¤ã¥è¡¦¡¦¡äáà¢ä!Úä!¡¦¡¦¡¦¼ã£ìáá¸ã¡çáã¡¦¥ê¥â¡¦£ð¥â°ã¡ì¡¦Òä!§ã¡æ¡¦¶ä"¢æ\8e¼¼ã¡ïáâ¸ä!Þæ*¶æ¡¦¡¦§ã£ááâ¤ã¥æ¡¦ è¿½å´¢¡¦¡¦£â¥ã³ã¥é¡¦¡¦¡ì¡¦¶ä!ºä ¢ä!Êä"²ä!¡¦\80¢ä!Úä!¡¦¡¦¡¦¼ã£ìåæ¡¦!¡¦»ó¡¦¡¦¡÷¡¦Þä!¡¦Çç¡¦Äç!¸æ³þ¡¦Îä!Þæ*¶æ¡¦¡¦§ã¡â¡¦¸ä!°ã¡ý¡¦¡¦»ó¡¦¡¦Ëç¡¦¤æ¡¦åëÊæ:¡¦!¡¦»ó¡¦¡¦¡÷¡¦¾ã¡ù¡¦
5241                 </p>
5242
5243                 <h3>Bookmarklet</h3>
5244                 <p>
5245                         ä¸¶ä!¡¦¥åáã³ã£è±ã¡¦¡¦¡¦Ää ¸ä!´å\8e®Îä!¡¦¡¦¥â´ä ºä"¤ä!Îä!¾ä!¡¦¥ä¡¦¼ã¥æ¥ãÀä#¼ã¡æ¥ã²ä#¡¦¥ã¡¦°ã¡ä¥áºä!¾ã¡ù¡¦¡¦small>(¡¦Úä!¡¦±í¡¦¡¦¥æ¡¦¹ã¥è¡¦Îä!¡¦¡ð¥áÞä!¡¦@´å¿è¡¦¡¦¹øç´Èä!¡¦·é¡¦¡¦¥åáã³ã£è¥âÄä"¡¦¥åáã¡¦"¡¦¡÷¡¦¡¦¡ð¥á¡¦¡ï¡¦ ¡¦Êä!¡¦</small>
5246                         <br />
5247                         <br />
5248                         <a href="<?php echo htmlspecialchars($bm)?>">Add to <?php echo $blog->getShortName()?></a> (¡¦»ã¡äáâÆä!¡¦¡çáãÌä#¡¦£ãáâ¶ã¡ä¡¦Êä\8e»Øä!Îä!¾ã¡ù)
5249                 </p>
5250
5251                 <h3>¡¦³ã£è¥ã¡¦¥ã¡¦¡¦¥á¥ã¶ä#¥ã¥îáá¡¦£âáã³ã£í¥ã°ä#¼ã¥æ\8eÀ(Windows¡¦¡¦Eä½¿çÇäçù¡¦</h3>
5252                 <p>
5253                         <?php
5254                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5255                                 $url = $manager->addTicketToUrl($url);
5256                         ?>
5257                         ¡¦¤ä"¶ä!¡¦!°Þa href="<?php echo htmlspecialchars($url) ?>">¡¦³ã£è¥ã¡¦¥ã¡¦¡¦¥á¥ã¶ä#¥ã¥î:/a>¡¦¡¦£âáã³ã£í¥ã°ä#¼ã¥æ¥áÒä"¶ä!Æä!¡¦£â¡¦§ã¡í¡¦¾ã¡ù (¡¦¸ç6¶ä!¾ä ºä"Äç!¸æ³þ¡¦Òä"¸ä!°çÕêè§¡¦¡¦£ìáâ¹ã¥è¡¦¡¦¡æù»é·éááÎä!¾ã¡ù)
5258                 </p>
5259
5260                 <p>
5261                         ¡¦Æä!¡¦£âáã³ã£í¥ã°ä#¼ã¥æ¥áÎä!Þå/³ã£è¥ã¡¦¥ã¡¦¡¦¥á¥ã¶ä#¥ã¥îáâÄæÝäéâ\8e¸¡¦Òä"¶ä!Þä"¢ä!¡¦¡èñ¦¡¦¡¦¡¦èµ·åµõ¡¦¸å^¡¦\8e¤¢ä!§ã¡ù¡¦
5262                 </p>
5263
5264                 <h3>¡¦¢ã¥ê¥â¤ã¥ê¥â¹ã¥è¡¦¼ã¥æ\8eÜ/h3>
5265                 <p>
5266                         ¡¦¸ä!´å\8e®Îä!¡¦¡¦¥â´ä ºä"¤ä!Îä!¾ä!¡¦¥ä¡¦¼ã¥æ¥ãÀä#¼ã¡ë¡¦²å\8e´°ä!Òä!¡¦¡è¥à¢å-Ðä!¡¦±ê¡¦¤ã¡ù¡¦¶ä! ¡¦Âä!§ã¡ù¡¦
5267                 </p>
5268
5269                 <p>
5270                         ¡¦³ã£è¥ã¡¦¥ã¡¦¡¦¥á¥ã¶ä#¥ã¥îáá¶ä"²å\8e´°ä!Îä!Þä!¡¦Íâ¡¦¡¦\80¢ä\8e¹¥ä·é¡¦¡¦±ëé¡¡¦"Äæ\8e¶¾ä"Æä!§ã¡ï¡¦ ¡¦Êä!¡¦
5271                 </p>
5272
5273                 <ol>
5274                         <li>¡¦¹ã£ð¥ã¼ã¥è¡¦¡ã¥ë¡¦¥ã¥îáá¶ä"²ä ¸ä#Êä"¡ã£âáã¡¦£òåê¡¦MÔä!Îä!¡¦¡¦è¡¡¦..¡¦ºä"Äç!¸æ³þ</li>
5275                         <li>"regedit" ¡¦¡¦¡¦¡¦¡¦/li>
5276                         <li>"OK" ¡¦Øä"¿ã¥ê¥âÄå¡¦áá¡¦/li>
5277                         <li>"\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt" ¡¦Ää#¡¦#¡¦¥îáá¡¦¸¡¦¶ä"²å\8e¢ØæS¡¦/li>
5278                         <li>"add to weblog" ¡¦¡¦¥ê¥ã°ä#¡¦£ò¡¦´ç9¡¦/li>
5279                 </ol>
5280
5281                 <?php
5282                 $this->pagefoot();
5283
5284         }
5285
5286         /**
5287          * @todo document this
5288          */
5289         function action_actionlog() {
5290                 global $member, $manager;
5291
5292                 $member->isAdmin() or $this->disallow();
5293
5294                 $this->pagehead();
5295
5296                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5297
5298                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5299
5300                 ?>
5301                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5302                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5303                 <?php
5304                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5305
5306                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5307                 $template['content'] = 'actionlist';
5308                 $amount = showlist($query,'table',$template);
5309
5310                 $this->pagefoot();
5311
5312         }
5313
5314         /**
5315          * @todo document this
5316          */
5317         function action_banlist() {
5318                 global $member, $manager;
5319
5320                 $blogid = intRequestVar('blogid');
5321
5322                 $member->blogAdminRights($blogid) or $this->disallow();
5323
5324                 $blog =& $manager->getBlog($blogid);
5325
5326                 $this->pagehead();
5327
5328                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5329
5330                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5331
5332                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5333                 $template['content'] = 'banlist';
5334                 $amount = showlist($query,'table',$template);
5335
5336                 if ($amount == 0)
5337                         echo _BAN_NONE;
5338
5339                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5340                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5341
5342
5343                 $this->pagefoot();
5344
5345         }
5346
5347         /**
5348          * @todo document this
5349          */
5350         function action_banlistdelete() {
5351                 global $member, $manager;
5352
5353                 $blogid = intRequestVar('blogid');
5354                 $iprange = requestVar('iprange');
5355
5356                 $member->blogAdminRights($blogid) or $this->disallow();
5357
5358                 $blog =& $manager->getBlog($blogid);
5359
5360                 $this->pagehead();
5361                 ?>
5362                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5363
5364                         <form method="post" action="index.php">
5365
5366                         <h3><?php echo _BAN_IPRANGE?></h3>
5367
5368                         <p>
5369                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>
5370                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />
5371                         </p>
5372
5373                         <h3><?php echo _BAN_BLOGS?></h3>
5374
5375                         <div>
5376                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5377                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">Only blog '<?php echo htmlspecialchars($blog->getName())?>'</label>
5378                                 <br />
5379                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5380                         </div>
5381
5382                         <h3><?php echo _BAN_DELETE_TITLE?></h3>
5383
5384                         <div>
5385                                 <?php $manager->addTicketHidden() ?>
5386                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5387                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5388                         </div>
5389
5390                         </form>
5391                 <?php
5392                 $this->pagefoot();
5393         }
5394
5395         /**
5396          * @todo document this
5397          */
5398         function action_banlistdeleteconfirm() {
5399                 global $member, $manager;
5400
5401                 $blogid = intPostVar('blogid');
5402                 $allblogs = postVar('allblogs');
5403                 $iprange = postVar('iprange');
5404
5405                 $member->blogAdminRights($blogid) or $this->disallow();
5406
5407                 $deleted = array();
5408
5409                 if (!$allblogs) {
5410                         if (BAN::removeBan($blogid, $iprange))
5411                                 array_push($deleted, $blogid);
5412                 } else {
5413                         // get blogs fot which member has admin rights
5414                         $adminblogs = $member->getAdminBlogs();
5415                         foreach ($adminblogs as $blogje) {
5416                                 if (BAN::removeBan($blogje, $iprange))
5417                                         array_push($deleted, $blogje);
5418                         }
5419                 }
5420
5421                 if (sizeof($deleted) == 0)
5422                         $this->error(_ERROR_DELETEBAN);
5423
5424                 $this->pagehead();
5425
5426                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5427                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5428                 echo "<p>"._BAN_REMOVED_TEXT."</p>";
5429
5430                 echo "<ul>";
5431                 foreach ($deleted as $delblog) {
5432                         $b =& $manager->getBlog($delblog);
5433                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";
5434                 }
5435                 echo "</ul>";
5436
5437                 $this->pagefoot();
5438
5439         }
5440
5441         /**
5442          * @todo document this
5443          */
5444         function action_banlistnewfromitem() {
5445                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5446         }
5447
5448         /**
5449          * @todo document this
5450          */
5451         function action_banlistnew($blogid = '') {
5452                 global $member, $manager;
5453
5454                 if ($blogid == '')
5455                         $blogid = intRequestVar('blogid');
5456
5457                 $ip = requestVar('ip');
5458
5459                 $member->blogAdminRights($blogid) or $this->disallow();
5460
5461                 $blog =& $manager->getBlog($blogid);
5462
5463                 $this->pagehead();
5464                 ?>
5465                 <h2><?php echo _BAN_ADD_TITLE?></h2>
5466
5467
5468                 <form method="post" action="index.php">
5469
5470                 <h3><?php echo _BAN_IPRANGE?></h3>
5471
5472                 <p><?php echo _BAN_IPRANGE_TEXT?></p>
5473
5474                 <div class="note">
5475                 <b>An example</b>: "134.58.253.193" will only block one computer, while "134.58.253" will block 256 IP addresses, including the one from the first example.
5476                 </div>
5477
5478                 <div>
5479                 <?php                   if ($ip) {
5480                 ?>
5481                         <input name="iprange" type="radio" value="<?php echo htmlspecialchars($ip)?>" checked="checked" id="ip_fixed" /><label for="ip_fixed"><?php echo htmlspecialchars($ip)?></label>
5482                         <br />
5483                         <input name="iprange" type="radio" value="custom" id="ip_custom" /><label for="ip_custom">Custom: </label><input name='customiprange' value='<?php echo htmlspecialchars($ip)?>' maxlength='15' size='15' />
5484                 <?php   } else {
5485                                 echo "<input name='iprange' value='custom' type='hidden' />";
5486                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5487                         }
5488                 ?>
5489                 </div>
5490
5491                 <h3><?php echo _BAN_BLOGS?></h3>
5492
5493                 <p><?php echo _BAN_BLOGS_TEXT?></p>
5494
5495                 <div>
5496                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5497                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>
5498                         <br />
5499                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5500                 </div>
5501
5502                 <h3><?php echo _BAN_REASON_TITLE?></h3>
5503
5504                 <p><?php echo _BAN_REASON_TEXT?></p>
5505
5506                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5507
5508                 <h3><?php echo _BAN_ADD_TITLE?></h3>
5509
5510                 <div>
5511                         <input name="action" type="hidden" value="banlistadd" />
5512                         <?php $manager->addTicketHidden() ?>
5513                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5514                 </div>
5515
5516                 </form>
5517
5518                 <?php           $this->pagefoot();
5519         }
5520
5521         /**
5522          * @todo document this
5523          */
5524         function action_banlistadd() {
5525                 global $member;
5526
5527                 $blogid =               intPostVar('blogid');
5528                 $allblogs =     postVar('allblogs');
5529                 $iprange =              postVar('iprange');
5530                 if ($iprange == "custom")
5531                         $iprange = postVar('customiprange');
5532                 $reason =               postVar('reason');
5533
5534                 $member->blogAdminRights($blogid) or $this->disallow();
5535
5536                 // TODO: check IP range validity
5537
5538                 if (!$allblogs) {
5539                         if (!BAN::addBan($blogid, $iprange, $reason))
5540                                 $this->error(_ERROR_ADDBAN);
5541                 } else {
5542                         // get blogs fot which member has admin rights
5543                         $adminblogs = $member->getAdminBlogs();
5544                         $failed = 0;
5545                         foreach ($adminblogs as $blogje) {
5546                                 if (!BAN::addBan($blogje, $iprange, $reason))
5547                                         $failed = 1;
5548                         }
5549                         if ($failed)
5550                                 $this->error(_ERROR_ADDBAN);
5551                 }
5552
5553                 $this->action_banlist();
5554
5555         }
5556
5557         /**
5558          * @todo document this
5559          */
5560         function action_clearactionlog() {
5561                 global $member;
5562
5563                 $member->isAdmin() or $this->disallow();
5564
5565                 ACTIONLOG::clear();
5566
5567                 $this->action_manage(_MSG_ACTIONLOGCLEARED);
5568         }
5569
5570         /**
5571          * @todo document this
5572          */
5573         function action_backupoverview() {
5574                 global $member, $manager;
5575
5576                 $member->isAdmin() or $this->disallow();
5577
5578                 $this->pagehead();
5579
5580                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5581                 ?>
5582                 <h2><?php echo _BACKUPS_TITLE?></h2>
5583
5584                 <h3><?php echo _BACKUP_TITLE?></h3>
5585
5586                 <p><?php echo _BACKUP_INTRO?></p>
5587
5588                 <form method="post" action="index.php"><p>
5589                 <input type="hidden" name="action" value="backupcreate" />
5590                 <?php $manager->addTicketHidden() ?>
5591
5592                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5593                 <br />
5594                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5595                 <br /><br />
5596                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5597
5598                 </p></form>
5599
5600                 <div class="note"><?php echo _BACKUP_NOTE?></div>
5601
5602
5603                 <h3><?php echo _RESTORE_TITLE?></h3>
5604
5605                 <div class="note"><?php echo _RESTORE_NOTE?></div>
5606
5607                 <p><?php echo _RESTORE_INTRO?></p>
5608
5609                 <form method="post" action="index.php" enctype="multipart/form-data"><p>
5610                         <input type="hidden" name="action" value="backuprestore" />
5611                         <?php $manager->addTicketHidden() ?>
5612                         <input name="backup_file" type="file" tabindex="30" />
5613                         <br /><br />
5614                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5615                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5616                         <br /><?php echo _RESTORE_WARNING?>
5617                 </p></form>
5618
5619                 <?php           $this->pagefoot();
5620         }
5621
5622         /**
5623          * @todo document this
5624          */
5625         function action_backupcreate() {
5626                 global $member, $DIR_LIBS;
5627
5628                 $member->isAdmin() or $this->disallow();
5629
5630                 // use compression ?
5631                 $useGzip = intval(postVar('gzip'));
5632
5633                 include($DIR_LIBS . 'backup.php');
5634
5635                 // try to extend time limit
5636                 // (creating/restoring dumps might take a while)
5637                 @set_time_limit(1200);
5638
5639                 do_backup($useGzip);
5640                 exit;
5641         }
5642
5643         /**
5644          * @todo document this
5645          */
5646         function action_backuprestore() {
5647                 global $member, $DIR_LIBS;
5648
5649                 $member->isAdmin() or $this->disallow();
5650
5651                 if (intPostVar('letsgo') != 1)
5652                         $this->error(_ERROR_BACKUP_NOTSURE);
5653
5654                 include($DIR_LIBS . 'backup.php');
5655
5656                 // try to extend time limit
5657                 // (creating/restoring dumps might take a while)
5658                 @set_time_limit(1200);
5659
5660                 $message = do_restore();
5661                 if ($message != '')
5662                         $this->error($message);
5663
5664                 $this->pagehead();
5665                 ?>
5666                 <h2><?php echo _RESTORE_COMPLETE?></h2>
5667                 <?php           $this->pagefoot();
5668
5669         }
5670
5671         /**
5672          * @todo document this
5673          */
5674         function action_pluginlist() {
5675                 global $member, $manager;
5676
5677                 // check if allowed
5678                 $member->isAdmin() or $this->disallow();
5679
5680                 $this->pagehead();
5681
5682                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5683
5684                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
5685
5686                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';
5687
5688
5689                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
5690
5691                 $template['content'] = 'pluginlist';
5692                 $template['tabindex'] = 10;
5693                 showlist($query, 'table', $template);
5694
5695                 ?>
5696                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
5697
5698                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
5699
5700                         <form method="post" action="index.php"><div>
5701                                 <input type="hidden" name="action" value="pluginupdate" />
5702                                 <?php $manager->addTicketHidden() ?>
5703                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
5704                         </div></form>
5705
5706                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
5707
5708                         <?php                           // find a list of possibly non-installed plugins
5709                                 $candidates = array();
5710                                 global $DIR_PLUGINS;
5711                                 $dirhandle = opendir($DIR_PLUGINS);
5712                                 while ($filename = readdir($dirhandle)) {
5713                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
5714                                                 $name = $matches[1];
5715                                                 // only show in list when not yet installed
5716                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
5717                                                 if (mysql_num_rows($res) == 0)
5718                                                         array_push($candidates,$name);
5719                                         }
5720                                 }
5721                                 closedir($dirhandle);
5722
5723                                 if (sizeof($candidates) > 0) {
5724                         ?>
5725
5726                         <p><?php echo _PLUGS_ADD_TEXT?></p>
5727
5728
5729                         <form method='post' action='index.php'><div>
5730                                 <input type='hidden' name='action' value='pluginadd' />
5731                                 <?php $manager->addTicketHidden() ?>
5732                                 <select name="filename" tabindex="30">
5733                                 <?php                                   foreach($candidates as $name)
5734                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
5735                                 ?>
5736                                 </select>
5737                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
5738                         </div></form>
5739
5740                 <?php                   } else {        // sizeof(candidates) == 0
5741                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
5742                         }
5743
5744                 $this->pagefoot();
5745         }
5746
5747         /**
5748          * @todo document this
5749          */
5750         function action_pluginhelp() {
5751                 global $member, $manager, $DIR_PLUGINS, $CONF;
5752
5753                 // check if allowed
5754                 $member->isAdmin() or $this->disallow();
5755
5756                 $plugid = intGetVar('plugid');
5757
5758                 if (!$manager->pidInstalled($plugid))
5759                         $this->error(_ERROR_NOSUCHPLUGIN);
5760
5761                 $plugName = getPluginNameFromPid($plugid);
5762
5763                 $this->pagehead();
5764
5765                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
5766
5767                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';
5768
5769                 $plug =& $manager->getPlugin($plugName);
5770                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
5771
5772                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
5773                         @readfile($helpFile);
5774                 } else {
5775                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
5776                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
5777                 }
5778
5779
5780                 $this->pagefoot();
5781         }
5782
5783         /**
5784          * @todo document this
5785          */
5786         function action_pluginadd() {
5787                 global $member, $manager, $DIR_PLUGINS;
5788
5789                 // check if allowed
5790                 $member->isAdmin() or $this->disallow();
5791
5792                 $name = postVar('filename');
5793
5794                 if ($manager->pluginInstalled($name))
5795                         $this->error(_ERROR_DUPPLUGIN);
5796                 if (!checkPlugin($name))
5797                         $this->error(_ERROR_PLUGFILEERROR . ' (' . htmlspecialchars($name) . ')');
5798
5799                 // get number of currently installed plugins
5800                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
5801                 $numCurrent = mysql_num_rows($res);
5802
5803                 // plugin will be added as last one in the list
5804                 $newOrder = $numCurrent + 1;
5805
5806                 $manager->notify(
5807                         'PreAddPlugin',
5808                         array(
5809                                 'file' => &$name
5810                         )
5811                 );
5812
5813                 // do this before calling getPlugin (in case the plugin id is used there)
5814                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
5815                 sql_query($query);
5816                 $iPid = mysql_insert_id();
5817
5818                 $manager->clearCachedInfo('installedPlugins');
5819
5820                 // Load the plugin for condition checking and instalation
5821                 $plugin =& $manager->getPlugin($name);
5822
5823                 // check if it got loaded (could have failed)
5824                 if (!$plugin)
5825                 {
5826                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
5827                         $manager->clearCachedInfo('installedPlugins');
5828                         $this->error(_ERROR_PLUGIN_LOAD);
5829                 }
5830
5831                 // check if plugin needs a newer Nucleus version
5832                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())
5833                 {
5834                         // uninstall plugin again...
5835                         $this->deleteOnePlugin($plugin->getID());
5836
5837                         // ...and show error
5838                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars($plugin->getMinNucleusVersion()));
5839                 }
5840
5841                 // check if plugin needs a newer Nucleus version
5842                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
5843                 {
5844                         // uninstall plugin again...
5845                         $this->deleteOnePlugin($plugin->getID());
5846
5847                         // ...and show error
5848                         $this->error(_ERROR_NUCLEUSVERSIONREQ . htmlspecialchars( $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel() ) );
5849                 }
5850
5851                 $pluginList = $plugin->getPluginDep();
5852                 foreach ($pluginList as $pluginName)
5853                 {
5854
5855                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
5856                         if (mysql_num_rows($res) == 0)
5857                         {
5858                                 // uninstall plugin again...
5859                                 $this->deleteOnePlugin($plugin->getID());
5860
5861                                 $this->error(_ERROR_INSREQPLUGIN . htmlspecialchars($pluginName));
5862                         }
5863                 }
5864
5865                 // call the install method of the plugin
5866                 $plugin->install();
5867
5868                 $manager->notify(
5869                         'PostAddPlugin',
5870                         array(
5871                                 'plugin' => &$plugin
5872                         )
5873                 );
5874
5875                 // update all events
5876                 $this->action_pluginupdate();
5877         }
5878
5879         /**
5880          * @todo document this
5881          */
5882         function action_pluginupdate() {
5883                 global $member, $manager;
5884
5885                 // check if allowed
5886                 $member->isAdmin() or $this->disallow();
5887
5888                 // delete everything from plugin_events
5889                 sql_query('DELETE FROM '.sql_table('plugin_event'));
5890
5891                 // loop over all installed plugins
5892                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
5893                 while($o = mysql_fetch_object($res)) {
5894                         $pid = $o->pid;
5895                         $plug =& $manager->getPlugin($o->pfile);
5896                         if ($plug)
5897                         {
5898                                 $eventList = $plug->getEventList();
5899                                 foreach ($eventList as $eventName)
5900                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
5901                         }
5902                 }
5903
5904                 $this->action_pluginlist();
5905         }
5906
5907         /**
5908          * @todo document this
5909          */
5910         function action_plugindelete() {
5911                 global $member, $manager;
5912
5913                 // check if allowed
5914                 $member->isAdmin() or $this->disallow();
5915
5916                 $pid = intGetVar('plugid');
5917
5918                 if (!$manager->pidInstalled($pid))
5919                         $this->error(_ERROR_NOSUCHPLUGIN);
5920
5921                 $this->pagehead();
5922                 ?>
5923                         <h2><?php echo _DELETE_CONFIRM?></h2>
5924
5925                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
5926
5927                         <form method="post" action="index.php"><div>
5928                         <?php $manager->addTicketHidden() ?>
5929                         <input type="hidden" name="action" value="plugindeleteconfirm" />
5930                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
5931                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5932                         </div></form>
5933                 <?php           $this->pagefoot();
5934         }
5935
5936         /**
5937          * @todo document this
5938          */
5939         function action_plugindeleteconfirm() {
5940                 global $member, $manager;
5941
5942                 // check if allowed
5943                 $member->isAdmin() or $this->disallow();
5944
5945                 $pid = intPostVar('plugid');
5946
5947                 $error = $this->deleteOnePlugin($pid, 1);
5948                 if ($error) {
5949                         $this->error($error);
5950                 }
5951
5952                 $this->action_pluginlist();
5953         }
5954
5955         /**
5956          * @todo document this
5957          */
5958         function deleteOnePlugin($pid, $callUninstall = 0) {
5959                 global $manager;
5960
5961                 $pid = intval($pid);
5962
5963                 if (!$manager->pidInstalled($pid))
5964                         return _ERROR_NOSUCHPLUGIN;
5965
5966                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
5967
5968                 // call the unInstall method of the plugin
5969                 if ($callUninstall) {
5970                         $plugin =& $manager->getPlugin($name);
5971                         if ($plugin) $plugin->unInstall();
5972                 }
5973
5974                 // check dependency before delete
5975                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
5976                 while($o = mysql_fetch_object($res)) {
5977                         $plug =& $manager->getPlugin($o->pfile);
5978                         if ($plug)
5979                         {
5980                                 $depList = $plug->getPluginDep();
5981                                 foreach ($depList as $depName)
5982                                 {
5983                                         if ($name == $depName)
5984                                         {
5985                                                 return _ERROR_DELREQPLUGIN . $o->pfile;
5986                                         }
5987                                 }
5988                         }
5989                 }
5990
5991                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));
5992
5993                 // delete all subscriptions
5994                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
5995
5996                 // delete all options
5997                 // get OIDs from plugin_option_desc
5998                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5999                 $aOIDs = array();
6000                 while ($o = mysql_fetch_object($res)) {
6001                         array_push($aOIDs, $o->oid);
6002                 }
6003
6004                 // delete from plugin_option and plugin_option_desc
6005                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
6006                 if (count($aOIDs) > 0)
6007                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
6008
6009                 // update order numbers
6010                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
6011                 $o = mysql_fetch_object($res);
6012                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
6013
6014                 // delete row
6015                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
6016
6017                 $manager->clearCachedInfo('installedPlugins');
6018                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));
6019
6020                 return '';
6021         }
6022
6023         /**
6024          * @todo document this
6025          */
6026         function action_pluginup() {
6027                 global $member, $manager;
6028
6029                 // check if allowed
6030                 $member->isAdmin() or $this->disallow();
6031
6032                 $plugid = intGetVar('plugid');
6033
6034                 if (!$manager->pidInstalled($plugid))
6035                         $this->error(_ERROR_NOSUCHPLUGIN);
6036
6037                 // 1. get old order number
6038                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6039                 $o = mysql_fetch_object($res);
6040                 $oldOrder = $o->porder;
6041
6042                 // 2. calculate new order number
6043                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
6044
6045                 // 3. update plug numbers
6046                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6047                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6048
6049                 $this->action_pluginlist();
6050         }
6051
6052         /**
6053          * @todo document this
6054          */
6055         function action_plugindown() {
6056                 global $member, $manager;
6057
6058                 // check if allowed
6059                 $member->isAdmin() or $this->disallow();
6060
6061                 $plugid = intGetVar('plugid');
6062                 if (!$manager->pidInstalled($plugid))
6063                         $this->error(_ERROR_NOSUCHPLUGIN);
6064
6065                 // 1. get old order number
6066                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
6067                 $o = mysql_fetch_object($res);
6068                 $oldOrder = $o->porder;
6069
6070                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6071                 $maxOrder = mysql_num_rows($res);
6072
6073                 // 2. calculate new order number
6074                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6075
6076                 // 3. update plug numbers
6077                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6078                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6079
6080                 $this->action_pluginlist();
6081         }
6082
6083         /**
6084          * @todo document this
6085          */
6086         function action_pluginoptions($message = '') {
6087                 global $member, $manager;
6088
6089                 // check if allowed
6090                 $member->isAdmin() or $this->disallow();
6091
6092                 $pid = intRequestVar('plugid');
6093                 if (!$manager->pidInstalled($pid))
6094                         $this->error(_ERROR_NOSUCHPLUGIN);
6095
6096                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6097                 $this->pagehead($extrahead);
6098
6099                 ?>
6100                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6101
6102                         <h2>Options for <?php echo htmlspecialchars(getPluginNameFromPid($pid))?></h2>
6103
6104                         <?php if  ($message) echo $message?>
6105
6106                         <form action="index.php" method="post">
6107                         <div>
6108                                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6109                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6110
6111                 <?php
6112
6113                 $manager->addTicketHidden();
6114
6115                 $aOptions = array();
6116                 $aOIDs = array();
6117                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6118                 $r = sql_query($query);
6119                 while ($o = mysql_fetch_object($r)) {
6120                         array_push($aOIDs, $o->oid);
6121                         $aOptions[$o->oid] = array(
6122                                                 'oid' => $o->oid,
6123                                                 'value' => $o->odef,
6124                                                 'name' => $o->oname,
6125                                                 'description' => $o->odesc,
6126                                                 'type' => $o->otype,
6127                                                 'typeinfo' => $o->oextra,
6128                                                 'contextid' => 0
6129                         );
6130                 }
6131                 // fill out actual values
6132                 if (count($aOIDs) > 0) {
6133                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6134                         while ($o = mysql_fetch_object($r))
6135                                 $aOptions[$o->oid]['value'] = $o->ovalue;
6136                 }
6137
6138                 // call plugins
6139                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6140
6141                 $template['content'] = 'plugoptionlist';
6142                 $amount = showlist($aOptions,'table',$template);
6143                 if ($amount == 0)
6144                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6145
6146                 ?>
6147                         </div>
6148                         </form>
6149                 <?php           $this->pagefoot();
6150
6151
6152
6153         }
6154
6155         /**
6156          * @todo document this
6157          */
6158         function action_pluginoptionsupdate() {
6159                 global $member, $manager;
6160
6161                 // check if allowed
6162                 $member->isAdmin() or $this->disallow();
6163
6164                 $pid = intRequestVar('plugid');
6165                 if (!$manager->pidInstalled($pid))
6166                         $this->error(_ERROR_NOSUCHPLUGIN);
6167
6168                 $aOptions = requestArray('plugoption');
6169                 NucleusPlugin::_applyPluginOptions($aOptions);
6170
6171                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6172
6173                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6174         }
6175
6176         /**
6177          * @static
6178          * @todo document this
6179          */
6180         function _insertPluginOptions($context, $contextid = 0) {
6181                 // get all current values for this contextid
6182                 // (note: this might contain doubles for overlapping contextids)
6183                 $aIdToValue = array();
6184                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6185                 while ($o = mysql_fetch_object($res)) {
6186                         $aIdToValue[$o->oid] = $o->ovalue;
6187                 }
6188
6189                 // get list of oids per pid
6190                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6191                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
6192                 $res = sql_query($query);
6193                 $aOptions = array();
6194                 while ($o = mysql_fetch_object($res)) {
6195                         if (in_array($o->oid, array_keys($aIdToValue)))
6196                                 $value = $aIdToValue[$o->oid];
6197                         else
6198                                 $value = $o->odef;
6199
6200                         array_push($aOptions, array(
6201                                 'pid' => $o->pid,
6202                                 'pfile' => $o->pfile,
6203                                 'oid' => $o->oid,
6204                                 'value' => $value,
6205                                 'name' => $o->oname,
6206                                 'description' => $o->odesc,
6207                                 'type' => $o->otype,
6208                                 'typeinfo' => $o->oextra,
6209                                 'contextid' => $contextid,
6210                                 'extra' => ''
6211                         ));
6212                 }
6213
6214                 global $manager;
6215                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6216
6217
6218                 $iPrevPid = -1;
6219                 foreach ($aOptions as $aOption) {
6220
6221                         // new plugin?
6222                         if ($iPrevPid != $aOption['pid']) {
6223                                 $iPrevPid = $aOption['pid'];
6224
6225                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';
6226                         }
6227
6228                         echo '<tr>';
6229                         listplug_plugOptionRow($aOption);
6230                         echo '</tr>';
6231
6232                 }
6233
6234
6235         }
6236
6237         /**
6238          * Helper functions to create option forms etc.
6239          * @todo document parameters
6240          */
6241         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO, $isAdmin = 0) {
6242                 $id = htmlspecialchars($name);
6243                 $id = str_replace('[','-',$id);
6244                 $id = str_replace(']','-',$id);
6245                 $id1 = $id . htmlspecialchars($value1);
6246                 $id2 = $id . htmlspecialchars($value2);
6247
6248                 if ($name=="admin") {
6249                         echo '<input onclick="selectCanLogin(true);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6250                 } else {
6251                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6252                 }
6253
6254                         if ($checkedval == $value1)
6255                                 echo "tabindex='$tabindex' checked='checked'";
6256                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6257                 echo ' ';
6258                 if ($name=="admin") {
6259                         echo '<input onclick="selectCanLogin(false);" type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6260                 } else {
6261                         echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6262                 }
6263                         if ($checkedval != $value1)
6264                                 echo "tabindex='$tabindex' checked='checked'";
6265                         if ($isAdmin && $name=="canlogin")
6266                                 echo " disabled='true'";
6267                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6268         }
6269
6270 } // class ADMIN
6271
6272 ?>