utf8/nucleus/libs/ADMIN.php

   1 <?php
   2 /*
   3  * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
   4  * Copyright (C) 2002-2006 The Nucleus Group
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version 2
   9  * of the License, or (at your option) any later version.
  10  * (see nucleus/documentation/index.html#license for more info)
  11  */
  12 /**
  13  * The code for the Nucleus admin area
  14  *
  15  * @license http://nucleuscms.org/license.txt GNU General Public License
  16  * @copyright Copyright (C) 2002-2006 The Nucleus Group
  17  * @version $Id: ADMIN.php,v 1.9 2006-08-31 20:58:00 kimitake Exp $
  18  * @version $NucleusJP: ADMIN.php,v 1.8 2006/07/12 09:18:02 kimitake Exp $
  19  */
  20
  21 require_once "showlist.php";
  22
  23 /**
  24  * Builds the admin area and executes admin actions
  25  */
  26 class ADMIN {
  27
  28         /**
  29          * @var string $action action currently being executed ($action=xxxx -> action_xxxx method)
  30          */
  31         var $action;
  32
  33         /**
  34          * Class constructor
  35          */
  36         function ADMIN() {
  37
  38         }
  39
  40         /**
  41          * Executes an action
  42          *
  43          * @param string $action action to be performed
  44          */
  45         function action($action) {
  46                 global $CONF, $manager;
  47
  48                 // list of action aliases
  49                 $alias = array(
  50                         'login' => 'overview',
  51                         '' => 'overview'
  52                 );
  53
  54                 if (isset($alias[$action]))
  55                         $action = $alias[$action];
  56
  57                 $methodName = 'action_' . $action;
  58
  59                 $this->action = strtolower($action);
  60
  61                 // check ticket. All actions need a ticket, unless they are considered to be safe (a safe action
  62                 // is an action that requires user interaction before something is actually done)
  63                 // all safe actions are in this array:
  64                 $aActionsNotToCheck = array('showlogin', 'login', 'overview', 'itemlist', 'blogcommentlist', 'bookmarklet', 'blogsettings', 'banlist', 'deleteblog', 'editmembersettings', 'browseownitems', 'browseowncomments', 'createitem', 'itemedit', 'itemmove', 'categoryedit', 'categorydelete', 'manage', 'actionlog', 'settingsedit', 'backupoverview', 'pluginlist', 'createnewlog', 'usermanagement', 'skinoverview', 'templateoverview', 'skinieoverview', 'itemcommentlist', 'commentedit', 'commentdelete', 'banlistnewfromitem', 'banlistdelete', 'itemdelete', 'manageteam', 'teamdelete', 'banlistnew', 'memberedit', 'memberdelete', 'pluginhelp', 'pluginoptions', 'plugindelete', 'skinedittype', 'skinremovetype', 'skindelete', 'skinedit', 'templateedit', 'templatedelete', 'activate');
  65 /*
  66                 // the rest of the actions needs to be checked
  67                 $aActionsToCheck = array('additem', 'itemupdate', 'itemmoveto', 'categoryupdate', 'categorydeleteconfirm', 'itemdeleteconfirm', 'commentdeleteconfirm', 'teamdeleteconfirm', 'memberdeleteconfirm', 'templatedeleteconfirm', 'skindeleteconfirm', 'banlistdeleteconfirm', 'plugindeleteconfirm', 'batchitem', 'batchcomment', 'batchmember', 'batchcategory', 'batchteam', 'regfile', 'commentupdate', 'banlistadd', 'changemembersettings', 'clearactionlog', 'settingsupdate', 'blogsettingsupdate', 'categorynew', 'teamchangeadmin', 'teamaddmember', 'memberadd', 'addnewlog', 'addnewlog2', 'backupcreate', 'backuprestore', 'pluginup', 'plugindown', 'pluginupdate', 'pluginadd', 'pluginoptionsupdate', 'skinupdate', 'skinclone', 'skineditgeneral', 'templateclone', 'templatenew', 'templateupdate', 'skinieimport', 'skinieexport', 'skiniedoimport', 'skinnew', 'deleteblogconfirm', 'sendping', 'rawping', 'activatesetpwd');
  68 */
  69                 if (!in_array($this->action, $aActionsNotToCheck))
  70                 {
  71                         if (!$manager->checkTicket())
  72                                 $this->error(_ERROR_BADTICKET);
  73                 }
  74
  75                 if (method_exists($this, $methodName))
  76                         call_user_func(array(&$this, $methodName));
  77                 else
  78                         $this->error(_BADACTION . " ($action)");
  79
  80         }
  81
  82         /**
  83          * @todo document this
  84          */
  85         function action_showlogin() {
  86                 global $error;
  87                 $this->action_login($error);
  88         }
  89
  90         /**
  91          * @todo document this
  92          */
  93         function action_login($msg = '', $passvars = 1) {
  94                 global $member;
  95
  96                 // skip to overview when allowed
  97                 if ($member->isLoggedIn() && $member->canLogin()) {
  98                         $this->action_overview();
  99                         exit;
 100                 }
 101
 102                 $this->pagehead();
 103
 104                 echo '<h2>', _LOGIN ,'</h2>';
 105                 if ($msg) echo _MESSAGE , ': ', htmlspecialchars($msg);
 106                 ?>
 107
 108                 <form action="index.php" method="post"><p>
 109                 <?php echo _LOGIN_NAME?>: <br /><input name="login"  tabindex="10" />
 110                 <br />
 111                 <?php echo _LOGIN_PASSWORD?>: <br /><input name="password"  tabindex="20" type="password" />
 112                 <br />
 113                 <input name="action" value="login" type="hidden" />
 114                 <br />
 115                 <input type="submit" value="<?php echo _LOGIN?>" tabindex="30" />
 116                 <br />
 117                 <small>
 118                         <input type="checkbox" value="1" name="shared" tabindex="40" id="shared" /><label for="shared"><?php echo _LOGIN_SHARED?></label>
 119                         <br /><a href="forgotpassword.html"><?php echo _LOGIN_FORGOT?></a>
 120                 </small>
 121                 <?php                   // pass through vars
 122
 123                         $oldaction = postVar('oldaction');
 124                         if (  ($oldaction != 'logout')  && ($oldaction != 'login')  && $passvars ) {
 125                                 passRequestVars();
 126                         }
 127
 128
 129                 ?>
 130                 </p></form>
 131                 <?php           $this->pagefoot();
 132         }
 133
 134
 135         /**
 136          * provides a screen with the overview of the actions available
 137          * @todo document parameter
 138          */
 139         function action_overview($msg = '') {
 140                 global $member;
 141
 142                 $this->pagehead();
 143
 144                 if ($msg)
 145                         echo _MESSAGE , ': ', $msg;
 146
 147                 /* ---- add items ---- */
 148                 echo '<h2>' . _OVERVIEW_YRBLOGS . '</h2>';
 149
 150                 $showAll = requestVar('showall');
 151
 152                 if (($member->isAdmin()) && ($showAll == 'yes')) {
 153                         // Super-Admins have access to all blogs! (no add item support though)
 154                         $query =  'SELECT bnumber, bname, 1 as tadmin, burl, bshortname'
 155                                    . ' FROM ' . sql_table('blog')
 156                                    . ' ORDER BY bname';
 157                 } else {
 158                         $query =  'SELECT bnumber, bname, tadmin, burl, bshortname'
 159                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
 160                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
 161                                    . ' ORDER BY bname';
 162                 }
 163                 $template['content'] = 'bloglist';
 164                 $template['superadmin'] = $member->isAdmin();
 165                 $amount = showlist($query,'table',$template);
 166
 167                 if (($showAll != 'yes') && ($member->isAdmin())) {
 168                         $total = quickQuery('SELECT COUNT(*) as result FROM ' . sql_table('blog'));
 169                         if ($total > $amount)
 170                                 echo '<p><a href="index.php?action=overview&amp;showall=yes">Show all blogs</a></p>';
 171                 }
 172
 173                 if ($amount == 0)
 174                         echo _OVERVIEW_NOBLOGS;
 175
 176                 if ($amount != 0) {
 177                         echo '<h2>' . _OVERVIEW_YRDRAFTS . '</h2>';
 178                         $query =  'SELECT ititle, inumber, bshortname'
 179                                    . ' FROM ' . sql_table('item'). ', ' . sql_table('blog')
 180                                    . ' WHERE iauthor='.$member->getID().' and iblog=bnumber and idraft=1';
 181                         $template['content'] = 'draftlist';
 182                         $amountdrafts = showlist($query, 'table', $template);
 183                         if ($amountdrafts == 0)
 184                                 echo _OVERVIEW_NODRAFTS;
 185                 }
 186
 187                 /* ---- user settings ---- */
 188                 echo '<h2>' . _OVERVIEW_YRSETTINGS . '</h2>';
 189                 echo '<ul>';
 190                 echo '<li><a href="index.php?action=editmembersettings">' . _OVERVIEW_EDITSETTINGS. '</a></li>';
 191                 echo '<li><a href="index.php?action=browseownitems">' . _OVERVIEW_BROWSEITEMS.'</a></li>';
 192                 echo '<li><a href="index.php?action=browseowncomments">'._OVERVIEW_BROWSECOMM.'</a></li>';
 193                 echo '</ul>';
 194
 195                 /* ---- general settings ---- */
 196                 if ($member->isAdmin()) {
 197                         echo '<h2>' . _OVERVIEW_MANAGEMENT. '</h2>';
 198                         echo '<ul>';
 199                         echo '<li><a href="index.php?action=manage">',_OVERVIEW_MANAGE,'</a></li>';
 200                         echo '</ul>';
 201                 }
 202
 203
 204                 $this->pagefoot();
 205         }
 206
 207         /**
 208          * Returns a link to a weblog
 209          * @param object BLOG
 210          */
 211         function bloglink(&$blog) {
 212                 return '<a href="'.htmlspecialchars($blog->getURL()).'" title="'._BLOGLIST_TT_VISIT.'">'.$blog->getName() .'</a>';
 213         }
 214
 215         /**
 216          * @todo document this
 217          */
 218         function action_manage($msg = '') {
 219                 global $member;
 220
 221                 $member->isAdmin() or $this->disallow();
 222
 223                 $this->pagehead();
 224
 225                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 226
 227                 if ($msg)
 228                         echo '<p>' , _MESSAGE , ': ', $msg , '</p>';
 229
 230
 231                 echo '<h2>' . _MANAGE_GENERAL. '</h2>';
 232
 233                 echo '<ul>';
 234                 echo '<li><a href="index.php?action=createnewlog">'._OVERVIEW_NEWLOG.'</a></li>';
 235                 echo '<li><a href="index.php?action=settingsedit">'._OVERVIEW_SETTINGS.'</a></li>';
 236                 echo '<li><a href="index.php?action=usermanagement">'._OVERVIEW_MEMBERS.'</a></li>';
 237                 echo '<li><a href="index.php?action=actionlog">'._OVERVIEW_VIEWLOG.'</a></li>';
 238                 echo '</ul>';
 239
 240                 echo '<h2>' . _MANAGE_SKINS . '</h2>';
 241                 echo '<ul>';
 242                 echo '<li><a href="index.php?action=skinoverview">'._OVERVIEW_SKINS.'</a></li>';
 243                 echo '<li><a href="index.php?action=templateoverview">'._OVERVIEW_TEMPLATES.'</a></li>';
 244                 echo '<li><a href="index.php?action=skinieoverview">'._OVERVIEW_SKINIMPORT.'</a></li>';
 245                 echo '</ul>';
 246
 247                 echo '<h2>' . _MANAGE_EXTRA . '</h2>';
 248                 echo '<ul>';
 249                 echo '<li><a href="index.php?action=backupoverview">'._OVERVIEW_BACKUP.'</a></li>';
 250                 echo '<li><a href="index.php?action=pluginlist">'._OVERVIEW_PLUGINS.'</a></li>';
 251                 echo '</ul>';
 252
 253                 $this->pagefoot();
 254         }
 255
 256         /**
 257          * @todo document this
 258          */
 259         function action_itemlist($blogid = '') {
 260                 global $member, $manager;
 261
 262                 if ($blogid == '')
 263                         $blogid = intRequestVar('blogid');
 264
 265                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 266
 267                 $this->pagehead();
 268                 $blog =& $manager->getBlog($blogid);
 269
 270                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 271                 echo '<h2>' . _ITEMLIST_BLOG . ' ' . $this->bloglink($blog) . '</h2>';
 272
 273                 // start index
 274                 if (postVar('start'))
 275                         $start = intPostVar('start');
 276                 else
 277                         $start = 0;
 278
 279                 if ($start == 0)
 280                         echo '<p><a href="index.php?action=createitem&amp;blogid='.$blogid.'">',_ITEMLIST_ADDNEW,'</a></p>';
 281
 282                 // amount of items to show
 283                 if (postVar('amount'))
 284                         $amount = intPostVar('amount');
 285                 else
 286                         $amount = 10;
 287
 288                 $search = postVar('search');    // search through items
 289
 290                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, inumber, idraft, itime'
 291                            . ' FROM ' . sql_table('item') . ', ' . sql_table('blog') . ', ' . sql_table('member') . ', ' . sql_table('category')
 292                            . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 293
 294                 if ($search)
 295                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 296
 297                 // non-blog-admins can only edit/delete their own items
 298                 if (!$member->blogAdminRights($blogid))
 299                         $query .= ' and iauthor=' . $member->getID();
 300
 301
 302                 $query .= ' ORDER BY itime DESC'
 303                                 . " LIMIT $start,$amount";
 304
 305                 $template['content'] = 'itemlist';
 306                 $template['now'] = $blog->getCorrectTime(time());
 307
 308                 $manager->loadClass("ENCAPSULATE");
 309                 $navList =& new NAVLIST('itemlist', $start, $amount, 0, 1000, $blogid, $search, 0);
 310                 $navList->showBatchList('item',$query,'table',$template);
 311
 312
 313                 $this->pagefoot();
 314         }
 315
 316         /**
 317          * @todo document this
 318          */
 319         function action_batchitem() {
 320                 global $member, $manager;
 321
 322                 // check if logged in
 323                 $member->isLoggedIn() or $this->disallow();
 324
 325                 // more precise check will be done for each performed operation
 326
 327                 // get array of itemids from request
 328                 $selected = requestIntArray('batch');
 329                 $action = requestVar('batchaction');
 330
 331                 // Show error when no items were selected
 332                 if (!is_array($selected) || sizeof($selected) == 0)
 333                         $this->error(_BATCH_NOSELECTION);
 334
 335                 // On move: when no destination blog/category chosen, show choice now
 336                 $destCatid = intRequestVar('destcatid');
 337                 if (($action == 'move') && (!$manager->existsCategory($destCatid)))
 338                         $this->batchMoveSelectDestination('item',$selected);
 339
 340                 // On delete: check if confirmation has been given
 341                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 342                         $this->batchAskDeleteConfirmation('item',$selected);
 343
 344                 $this->pagehead();
 345
 346                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 347                 echo '<h2>',_BATCH_ITEMS,'</h2>';
 348                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 349                 echo '<ul>';
 350
 351
 352                 // walk over all itemids and perform action
 353                 foreach ($selected as $itemid) {
 354                         $itemid = intval($itemid);
 355                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONITEM,' <b>', $itemid, '</b>...';
 356
 357                         // perform action, display errors if needed
 358                         switch($action) {
 359                                 case 'delete':
 360                                         $error = $this->deleteOneItem($itemid);
 361                                         break;
 362                                 case 'move':
 363                                         $error = $this->moveOneItem($itemid, $destCatid);
 364                                         break;
 365                                 default:
 366                                         $error = _BATCH_UNKNOWN . $action;
 367                         }
 368
 369                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 370                         echo '</li>';
 371                 }
 372
 373                 echo '</ul>';
 374                 echo '<b>',_BATCH_DONE,'</b>';
 375
 376                 $this->pagefoot();
 377
 378
 379         }
 380
 381         /**
 382          * @todo document this
 383          */
 384         function action_batchcomment() {
 385                 global $member;
 386
 387                 // check if logged in
 388                 $member->isLoggedIn() or $this->disallow();
 389
 390                 // more precise check will be done for each performed operation
 391
 392                 // get array of itemids from request
 393                 $selected = requestIntArray('batch');
 394                 $action = requestVar('batchaction');
 395
 396                 // Show error when no items were selected
 397                 if (!is_array($selected) || sizeof($selected) == 0)
 398                         $this->error(_BATCH_NOSELECTION);
 399
 400                 // On delete: check if confirmation has been given
 401                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 402                         $this->batchAskDeleteConfirmation('comment',$selected);
 403
 404                 $this->pagehead();
 405
 406                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 407                 echo '<h2>',_BATCH_COMMENTS,'</h2>';
 408                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 409                 echo '<ul>';
 410
 411                 // walk over all itemids and perform action
 412                 foreach ($selected as $commentid) {
 413                         $commentid = intval($commentid);
 414                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCOMMENT,' <b>', $commentid, '</b>...';
 415
 416                         // perform action, display errors if needed
 417                         switch($action) {
 418                                 case 'delete':
 419                                         $error = $this->deleteOneComment($commentid);
 420                                         break;
 421                                 default:
 422                                         $error = _BATCH_UNKNOWN . $action;
 423                         }
 424
 425                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 426                         echo '</li>';
 427                 }
 428
 429                 echo '</ul>';
 430                 echo '<b>',_BATCH_DONE,'</b>';
 431
 432                 $this->pagefoot();
 433
 434
 435         }
 436
 437         /**
 438          * @todo document this
 439          */
 440         function action_batchmember() {
 441                 global $member;
 442
 443                 // check if logged in and admin
 444                 ($member->isLoggedIn() && $member->isAdmin()) or $this->disallow();
 445
 446                 // get array of itemids from request
 447                 $selected = requestIntArray('batch');
 448                 $action = requestVar('batchaction');
 449
 450                 // Show error when no members selected
 451                 if (!is_array($selected) || sizeof($selected) == 0)
 452                         $this->error(_BATCH_NOSELECTION);
 453
 454                 // On delete: check if confirmation has been given
 455                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 456                         $this->batchAskDeleteConfirmation('member',$selected);
 457
 458                 $this->pagehead();
 459
 460                 echo '<a href="index.php?action=usermanagement">(',_MEMBERS_BACKTOOVERVIEW,')</a>';
 461                 echo '<h2>',_BATCH_MEMBERS,'</h2>';
 462                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 463                 echo '<ul>';
 464
 465                 // walk over all itemids and perform action
 466                 foreach ($selected as $memberid) {
 467                         $memberid = intval($memberid);
 468                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONMEMBER,' <b>', $memberid, '</b>...';
 469
 470                         // perform action, display errors if needed
 471                         switch($action) {
 472                                 case 'delete':
 473                                         $error = $this->deleteOneMember($memberid);
 474                                         break;
 475                                 case 'setadmin':
 476                                         // always succeeds
 477                                         sql_query('UPDATE ' . sql_table('member') . ' SET madmin=1 WHERE mnumber='.$memberid);
 478                                         $error = '';
 479                                         break;
 480                                 case 'unsetadmin':
 481                                         // there should always remain at least one super-admin
 482                                         $r = sql_query('SELECT * FROM '.sql_table('member'). ' WHERE madmin=1 and mcanlogin=1');
 483                                         if (mysql_num_rows($r) < 2)
 484                                                 $error = _ERROR_ATLEASTONEADMIN;
 485                                         else
 486                                                 sql_query('UPDATE ' . sql_table('member') .' SET madmin=0 WHERE mnumber='.$memberid);
 487                                         break;
 488                                 default:
 489                                         $error = _BATCH_UNKNOWN . $action;
 490                         }
 491
 492                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 493                         echo '</li>';
 494                 }
 495
 496                 echo '</ul>';
 497                 echo '<b>',_BATCH_DONE,'</b>';
 498
 499                 $this->pagefoot();
 500
 501
 502         }
 503
 504         /**
 505          * @todo document this
 506          */
 507         function action_batchteam() {
 508                 global $member;
 509
 510                 $blogid = intRequestVar('blogid');
 511
 512                 // check if logged in and admin
 513                 ($member->isLoggedIn() && $member->blogAdminRights($blogid)) or $this->disallow();
 514
 515                 // get array of itemids from request
 516                 $selected = requestIntArray('batch');
 517                 $action = requestVar('batchaction');
 518
 519                 // Show error when no members selected
 520                 if (!is_array($selected) || sizeof($selected) == 0)
 521                         $this->error(_BATCH_NOSELECTION);
 522
 523                 // On delete: check if confirmation has been given
 524                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 525                         $this->batchAskDeleteConfirmation('team',$selected);
 526
 527                 $this->pagehead();
 528
 529                 echo '<p><a href="index.php?action=manageteam&amp;blogid=',$blogid,'">(',_BACK,')</a></p>';
 530
 531                 echo '<h2>',_BATCH_TEAM,'</h2>';
 532                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 533                 echo '<ul>';
 534
 535                 // walk over all itemids and perform action
 536                 foreach ($selected as $memberid) {
 537                         $memberid = intval($memberid);
 538                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONTEAM,' <b>', $memberid, '</b>...';
 539
 540                         // perform action, display errors if needed
 541                         switch($action) {
 542                                 case 'delete':
 543                                         $error = $this->deleteOneTeamMember($blogid, $memberid);
 544                                         break;
 545                                 case 'setadmin':
 546                                         // always succeeds
 547                                         sql_query('UPDATE '.sql_table('team').' SET tadmin=1 WHERE tblog='.$blogid.' and tmember='.$memberid);
 548                                         $error = '';
 549                                         break;
 550                                 case 'unsetadmin':
 551                                         // there should always remain at least one admin
 552                                         $r = sql_query('SELECT * FROM '.sql_table('team').' WHERE tadmin=1 and tblog='.$blogid);
 553                                         if (mysql_num_rows($r) < 2)
 554                                                 $error = _ERROR_ATLEASTONEBLOGADMIN;
 555                                         else
 556                                                 sql_query('UPDATE '.sql_table('team').' SET tadmin=0 WHERE tblog='.$blogid.' and tmember='.$memberid);
 557                                         break;
 558                                 default:
 559                                         $error = _BATCH_UNKNOWN . $action;
 560                         }
 561
 562                         echo '<b>',($error ? $error : _BATCH_SUCCESS),'</b>';
 563                         echo '</li>';
 564                 }
 565
 566                 echo '</ul>';
 567                 echo '<b>',_BATCH_DONE,'</b>';
 568
 569                 $this->pagefoot();
 570
 571
 572         }
 573
 574         /**
 575          * @todo document this
 576          */
 577         function action_batchcategory() {
 578                 global $member, $manager;
 579
 580                 // check if logged in
 581                 $member->isLoggedIn() or $this->disallow();
 582
 583                 // more precise check will be done for each performed operation
 584
 585                 // get array of itemids from request
 586                 $selected = requestIntArray('batch');
 587                 $action = requestVar('batchaction');
 588
 589                 // Show error when no items were selected
 590                 if (!is_array($selected) || sizeof($selected) == 0)
 591                         $this->error(_BATCH_NOSELECTION);
 592
 593                 // On move: when no destination blog chosen, show choice now
 594                 $destBlogId = intRequestVar('destblogid');
 595                 if (($action == 'move') && (!$manager->existsBlogID($destBlogId)))
 596                         $this->batchMoveCategorySelectDestination('category',$selected);
 597
 598                 // On delete: check if confirmation has been given
 599                 if (($action == 'delete') && (requestVar('confirmation') != 'yes'))
 600                         $this->batchAskDeleteConfirmation('category',$selected);
 601
 602                 $this->pagehead();
 603
 604                 echo '<a href="index.php?action=overview">(',_BACKHOME,')</a>';
 605                 echo '<h2>',BATCH_CATEGORIES,'</h2>';
 606                 echo '<p>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b></p>';
 607                 echo '<ul>';
 608
 609                 // walk over all itemids and perform action
 610                 foreach ($selected as $catid) {
 611                         $catid = intval($catid);
 612                         echo '<li>',_BATCH_EXECUTING,' <b>',htmlspecialchars($action),'</b> ',_BATCH_ONCATEGORY,' <b>', $catid, '</b>...';
 613
 614                         // perform action, display errors if needed
 615                         switch($action) {
 616                                 case 'delete':
 617                                         $error = $this->deleteOneCategory($catid);
 618                                         break;
 619                                 case 'move':
 620                                         $error = $this->moveOneCategory($catid, $destBlogId);
 621                                         break;
 622                                 default:
 623                                         $error = _BATCH_UNKNOWN . $action;
 624                         }
 625
 626                         echo '<b>',($error ? 'Error: '.$error : _BATCH_SUCCESS),'</b>';
 627                         echo '</li>';
 628                 }
 629
 630                 echo '</ul>';
 631                 echo '<b>',_BATCH_DONE,'</b>';
 632
 633                 $this->pagefoot();
 634
 635         }
 636
 637         /**
 638          * @todo document this
 639          */
 640         function batchMoveSelectDestination($type, $ids) {
 641                 global $manager;
 642                 $this->pagehead();
 643                 ?>
 644                 <h2><?php echo _MOVE_TITLE?></h2>
 645                 <form method="post" action="index.php"><div>
 646
 647                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 648                         <input type="hidden" name="batchaction" value="move" />
 649                         <?php
 650                                 $manager->addTicketHidden();
 651
 652                                 // insert selected item numbers
 653                                 $idx = 0;
 654                                 foreach ($ids as $id)
 655                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 656
 657                                 // show blog/category selection list
 658                                 $this->selectBlogCategory('destcatid');
 659
 660                         ?>
 661
 662
 663                         <input type="submit" value="<?php echo _MOVE_BTN?>" onclick="return checkSubmit();" />
 664
 665                 </div></form>
 666                 <?php           $this->pagefoot();
 667                 exit;
 668         }
 669
 670         /**
 671          * @todo document this
 672          */
 673         function batchMoveCategorySelectDestination($type, $ids) {
 674                 global $manager;
 675                 $this->pagehead();
 676                 ?>
 677                 <h2><?php echo _MOVECAT_TITLE?></h2>
 678                 <form method="post" action="index.php"><div>
 679
 680                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 681                         <input type="hidden" name="batchaction" value="move" />
 682                         <?php
 683                                 $manager->addTicketHidden();
 684
 685                                 // insert selected item numbers
 686                                 $idx = 0;
 687                                 foreach ($ids as $id)
 688                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 689
 690                                 // show blog/category selection list
 691                                 $this->selectBlog('destblogid');
 692
 693                         ?>
 694
 695
 696                         <input type="submit" value="<?php echo _MOVECAT_BTN?>" onclick="return checkSubmit();" />
 697
 698                 </div></form>
 699                 <?php           $this->pagefoot();
 700                 exit;
 701         }
 702
 703         /**
 704          * @todo document this
 705          */
 706         function batchAskDeleteConfirmation($type, $ids) {
 707                 global $manager;
 708
 709                 $this->pagehead();
 710                 ?>
 711                 <h2><?php echo _BATCH_DELETE_CONFIRM?></h2>
 712                 <form method="post" action="index.php"><div>
 713
 714                         <input type="hidden" name="action" value="batch<?php echo $type?>" />
 715                         <?php $manager->addTicketHidden() ?>
 716                         <input type="hidden" name="batchaction" value="delete" />
 717                         <input type="hidden" name="confirmation" value="yes" />
 718                         <?php                           // insert selected item numbers
 719                                 $idx = 0;
 720                                 foreach ($ids as $id)
 721                                         echo '<input type="hidden" name="batch[',($idx++),']" value="',intval($id),'" />';
 722
 723                                 // add hidden vars for team & comment
 724                                 if ($type == 'team')
 725                                 {
 726                                         echo '<input type="hidden" name="blogid" value="',intRequestVar('blogid'),'" />';
 727                                 }
 728                                 if ($type == 'comment')
 729                                 {
 730                                         echo '<input type="hidden" name="itemid" value="',intRequestVar('itemid'),'" />';
 731                                 }
 732
 733                         ?>
 734
 735                         <input type="submit" value="<?php echo _BATCH_DELETE_CONFIRM_BTN?>" onclick="return checkSubmit();" />
 736
 737                 </div></form>
 738                 <?php           $this->pagefoot();
 739                 exit;
 740         }
 741
 742
 743         /**
 744          * Inserts a HTML select element with choices for all categories to which the current
 745          * member has access
 746          * @see function selectBlog
 747          */
 748         function selectBlogCategory($name, $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 749                 ADMIN::selectBlog($name, 'category', $selected, $tabindex, $showNewCat, $iForcedBlogInclude);
 750         }
 751
 752         /**
 753          * Inserts a HTML select element with choices for all blogs to which the user has access
 754          *              mode = 'blog' => shows blognames and values are blogids
 755          *              mode = 'category' => show category names and values are catids
 756          *
 757          * @param $iForcedBlogInclude
 758          *              ID of a blog that always needs to be included, without checking if the
 759          *              member is on the blog team (-1 = none)
 760          * @todo document parameters
 761          */
 762         function selectBlog($name, $mode='blog', $selected = 0, $tabindex = 0, $showNewCat = 0, $iForcedBlogInclude = -1) {
 763                 global $member, $CONF;
 764
 765                 // 0. get IDs of blogs to which member can post items (+ forced blog)
 766                 $aBlogIds = array();
 767                 if ($iForcedBlogInclude != -1)
 768                         $aBlogIds[] = intval($iForcedBlogInclude);
 769
 770                 if (($member->isAdmin()) && ($CONF['ShowAllBlogs']))
 771                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').' ORDER BY bname';
 772                 else
 773                         $queryBlogs =  'SELECT bnumber FROM '.sql_table('blog').', '.sql_table('team').' WHERE tblog=bnumber and tmember=' . $member->getID();
 774                 $rblogids = sql_query($queryBlogs);
 775                 while ($o = mysql_fetch_object($rblogids))
 776                         if ($o->bnumber != $iForcedBlogInclude)
 777                                 $aBlogIds[] = intval($o->bnumber);
 778
 779                 if (count($aBlogIds) == 0)
 780                         return;
 781
 782                 echo '<select name="',$name,'" tabindex="',$tabindex,'">';
 783
 784                 // 1. select blogs (we'll create optiongroups)
 785                 // (only select those blogs that have the user on the team)
 786                 $queryBlogs =  'SELECT bnumber, bname FROM '.sql_table('blog').' WHERE bnumber in ('.implode(',',$aBlogIds).') ORDER BY bname';
 787                 $blogs = sql_query($queryBlogs);
 788                 if ($mode == 'category') {
 789                         if (mysql_num_rows($blogs) > 1)
 790                                 $multipleBlogs = 1;
 791
 792                         while ($oBlog = mysql_fetch_object($blogs)) {
 793                                 if ($multipleBlogs)
 794                                         echo '<optgroup label="',htmlspecialchars($oBlog->bname),'">';
 795
 796                                 // show selection to create new category when allowed/wanted
 797                                 if ($showNewCat) {
 798                                         // check if allowed to do so
 799                                         if ($member->blogAdminRights($oBlog->bnumber))
 800                                                 echo '<option value="newcat-',$oBlog->bnumber,'">',_ADD_NEWCAT,'</option>';
 801                                 }
 802
 803                                 // 2. for each category in that blog
 804                                 $categories = sql_query('SELECT cname, catid FROM '.sql_table('category').' WHERE cblog=' . $oBlog->bnumber . ' ORDER BY cname ASC');
 805                                 while ($oCat = mysql_fetch_object($categories)) {
 806                                         if ($oCat->catid == $selected)
 807                                                 $selectText = ' selected="selected" ';
 808                                         else
 809                                                 $selectText = '';
 810                                         echo '<option value="',$oCat->catid,'" ', $selectText,'>',htmlspecialchars($oCat->cname),'</option>';
 811                                 }
 812
 813                                 if ($multipleBlogs)
 814                                         echo '</optgroup>';
 815                         }
 816                 } else {
 817                         // blog mode
 818                         while ($oBlog = mysql_fetch_object($blogs)) {
 819                                 echo '<option value="',$oBlog->bnumber,'"';
 820                                 if ($oBlog->bnumber == $selected)
 821                                         echo ' selected="selected"';
 822                                 echo'>',htmlspecialchars($oBlog->bname),'</option>';
 823                         }
 824                 }
 825                 echo '</select>';
 826
 827         }
 828
 829         /**
 830          * @todo document this
 831          */
 832         function action_browseownitems() {
 833                 global $member, $manager;
 834
 835                 $this->pagehead();
 836
 837                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 838                 echo '<h2>' . _ITEMLIST_YOUR. '</h2>';
 839
 840                 // start index
 841                 if (postVar('start'))
 842                         $start = postVar('start');
 843                 else
 844                         $start = 0;
 845
 846                 // amount of items to show
 847                 if (postVar('amount'))
 848                         $amount = postVar('amount');
 849                 else
 850                         $amount = 10;
 851
 852                 $search = postVar('search');    // search through items
 853
 854                 $query =  'SELECT bshortname, cname, mname, ititle, ibody, idraft, inumber, itime'
 855                            . ' FROM '.sql_table('item').', '.sql_table('blog') . ', '.sql_table('member') . ', '.sql_table('category')
 856                            . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 857
 858                 if ($search)
 859                         $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
 860
 861                 $query .= ' ORDER BY itime DESC'
 862                                 . " LIMIT $start,$amount";
 863
 864                 $template['content'] = 'itemlist';
 865                 $template['now'] = time();
 866
 867                 $manager->loadClass("ENCAPSULATE");
 868                 $navList =& new NAVLIST('browseownitems', $start, $amount, 0, 1000, /*$blogid*/ 0, $search, 0);
 869                 $navList->showBatchList('item',$query,'table',$template);
 870
 871                 $this->pagefoot();
 872
 873         }
 874
 875         /**
 876          * Show all the comments for a given item
 877          * @param int $itemid
 878          */
 879         function action_itemcommentlist($itemid = '') {
 880                 global $member, $manager;
 881
 882                 if ($itemid == '')
 883                         $itemid = intRequestVar('itemid');
 884
 885                 // only allow if user is allowed to alter item
 886                 $member->canAlterItem($itemid) or $this->disallow();
 887
 888                 $blogid = getBlogIdFromItemId($itemid);
 889
 890                 $this->pagehead();
 891
 892                 // start index
 893                 if (postVar('start'))
 894                         $start = postVar('start');
 895                 else
 896                         $start = 0;
 897
 898                 // amount of items to show
 899                 if (postVar('amount'))
 900                         $amount = postVar('amount');
 901                 else
 902                         $amount = 10;
 903
 904                 $search = postVar('search');
 905
 906                 echo '<p>(<a href="index.php?action=itemlist&amp;blogid=',$blogid,'">',_BACKTOOVERVIEW,'</a>)</p>';
 907                 echo '<h2>',_COMMENTS,'</h2>';
 908
 909                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE citem=' . $itemid;
 910
 911                 if ($search)
 912                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 913
 914                 $query .= ' ORDER BY ctime ASC'
 915                                 . " LIMIT $start,$amount";
 916
 917                 $template['content'] = 'commentlist';
 918                 $template['canAddBan'] = $member->blogAdminRights(getBlogIDFromItemID($itemid));
 919
 920                 $manager->loadClass("ENCAPSULATE");
 921                 $navList =& new NAVLIST('itemcommentlist', $start, $amount, 0, 1000, 0, $search, $itemid);
 922                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS);
 923
 924                 $this->pagefoot();
 925         }
 926
 927         /**
 928          * Browse own comments
 929          */
 930         function action_browseowncomments() {
 931                 global $member, $manager;
 932
 933                 // start index
 934                 if (postVar('start'))
 935                         $start = postVar('start');
 936                 else
 937                         $start = 0;
 938
 939                 // amount of items to show
 940                 if (postVar('amount'))
 941                         $amount = postVar('amount');
 942                 else
 943                         $amount = 10;
 944
 945                 $search = postVar('search');
 946
 947
 948                 $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 949
 950                 if ($search)
 951                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
 952
 953                 $query .= ' ORDER BY ctime DESC'
 954                                 . " LIMIT $start,$amount";
 955
 956                 $this->pagehead();
 957
 958                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
 959                 echo '<h2>', _COMMENTS_YOUR ,'</h2>';
 960
 961                 $template['content'] = 'commentlist';
 962                 $template['canAddBan'] = 0;     // doesn't make sense to allow banning yourself
 963
 964                 $manager->loadClass("ENCAPSULATE");
 965                 $navList =& new NAVLIST('browseowncomments', $start, $amount, 0, 1000, 0, $search, 0);
 966                 $navList->showBatchList('comment',$query,'table',$template,_NOCOMMENTS_YOUR);
 967
 968                 $this->pagefoot();
 969         }
 970
 971         /**
 972          * Browse all comments for a weblog
 973          * @param int $blogid
 974          */
 975         function action_blogcommentlist($blogid = '')
 976         {
 977                 global $member, $manager;
 978
 979                 if ($blogid == '')
 980                         $blogid = intRequestVar('blogid');
 981                 else
 982                         $blogid = intval($blogid);
 983
 984                 $member->teamRights($blogid) or $member->isAdmin() or $this->disallow();
 985
 986                 // start index
 987                 if (postVar('start'))
 988                         $start = postVar('start');
 989                 else
 990                         $start = 0;
 991
 992                 // amount of items to show
 993                 if (postVar('amount'))
 994                         $amount = postVar('amount');
 995                 else
 996                         $amount = 10;
 997
 998                 $search = postVar('search');            // search through comments
 999
1000
1001                 $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
1002
1003                 if ($search != '')
1004                         $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
1005
1006
1007                 $query .= ' ORDER BY ctime DESC'
1008                                 . " LIMIT $start,$amount";
1009
1010
1011                 $blog =& $manager->getBlog($blogid);
1012
1013                 $this->pagehead();
1014
1015                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
1016                 echo '<h2>', _COMMENTS_BLOG , ' ' , $this->bloglink($blog), '</h2>';
1017
1018                 $template['content'] = 'commentlist';
1019                 $template['canAddBan'] = $member->blogAdminRights($blogid);
1020
1021                 $manager->loadClass("ENCAPSULATE");
1022                 $navList =& new NAVLIST('blogcommentlist', $start, $amount, 0, 1000, $blogid, $search, 0);
1023                 $navList->showBatchList('comment',$query,'table',$template, _NOCOMMENTS_BLOG);
1024
1025                 $this->pagefoot();
1026         }
1027
1028         /**
1029          * Provide a page to item a new item to the given blog
1030          */
1031         function action_createitem() {
1032                 global $member, $manager;
1033
1034                 $blogid = intRequestVar('blogid');
1035
1036                 // check if allowed
1037                 $member->teamRights($blogid) or $this->disallow();
1038
1039                 $memberid = $member->getID();
1040
1041                 $blog =& $manager->getBlog($blogid);
1042
1043                 $this->pagehead();
1044
1045                 // generate the add-item form
1046                 $formfactory =& new PAGEFACTORY($blogid);
1047                 $formfactory->createAddForm('admin');
1048
1049                 $this->pagefoot();
1050         }
1051
1052         /**
1053          * @todo document this
1054          */
1055         function action_itemedit() {
1056                 global $member, $manager;
1057
1058                 $itemid = intRequestVar('itemid');
1059
1060                 // only allow if user is allowed to alter item
1061                 $member->canAlterItem($itemid) or $this->disallow();
1062
1063                 $item =& $manager->getItem($itemid,1,1);
1064                 $blog =& $manager->getBlog(getBlogIDFromItemID($itemid));
1065
1066                 $manager->notify('PrepareItemForEdit', array('item' => &$item));
1067
1068                 if ($blog->convertBreaks()) {
1069                         $item['body'] = removeBreaks($item['body']);
1070                         $item['more'] = removeBreaks($item['more']);
1071                 }
1072
1073                 // form to edit blog items
1074                 $this->pagehead();
1075                 $formfactory =& new PAGEFACTORY($blog->getID());
1076                 $formfactory->createEditForm('admin',$item);
1077                 $this->pagefoot();
1078         }
1079
1080         /**
1081          * @todo document this
1082          */
1083         function action_itemupdate() {
1084                 global $member, $manager, $CONF;
1085
1086                 $itemid = intRequestVar('itemid');
1087                 $catid = postVar('catid');
1088
1089                 // only allow if user is allowed to alter item
1090                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1091
1092                 $actiontype = postVar('actiontype');
1093
1094                 // delete actions are handled by itemdelete (which has confirmation)
1095                 if ($actiontype == 'delete') {
1096                         $this->action_itemdelete();
1097                         return;
1098                 }
1099
1100                 $body   = postVar('body');
1101                 $title  = postVar('title');
1102                 $more   = postVar('more');
1103                 $closed = intPostVar('closed');
1104                 $draftid = intPostVar('draftid');
1105
1106                 // default action = add now
1107                 if (!$actiontype)
1108                         $actiontype='addnow';
1109
1110                 // create new category if needed
1111                 if (strstr($catid,'newcat')) {
1112                         // get blogid
1113                         list($blogid) = sscanf($catid,"newcat-%d");
1114
1115                         // create
1116                         $blog =& $manager->getBlog($blogid);
1117                         $catid = $blog->createNewCategory();
1118
1119                         // show error when sth goes wrong
1120                         if (!$catid)
1121                                 $this->doError(_ERROR_CATCREATEFAIL);
1122                 }
1123
1124                 /*
1125                         set some variables based on actiontype
1126
1127                         actiontypes:
1128                                 draft items -> addnow, addfuture, adddraft, delete
1129                                 non-draft items -> edit, changedate, delete
1130
1131                         variables set:
1132                                 $timestamp: set to a nonzero value for future dates or date changes
1133                                 $wasdraft: set to 1 when the item used to be a draft item
1134                                 $publish: set to 1 when the edited item is not a draft
1135                 */
1136                 switch ($actiontype) {
1137                         case 'adddraft':
1138                                 $publish = 0;
1139                                 $wasdraft = 1;
1140                                 $timestamp = 0;
1141                                 break;
1142                         case 'addfuture':
1143                                 $wasdraft = 1;
1144                                 $publish = 1;
1145                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1146                                 break;
1147                         case 'addnow':
1148                                 $wasdraft = 1;
1149                                 $publish = 1;
1150                                 $timestamp = 0;
1151                                 break;
1152                         case 'changedate':
1153                                 $timestamp = mktime(postVar('hour'), postVar('minutes'), 0, postVar('month'), postVar('day'), postVar('year'));
1154                                 $publish = 1;
1155                                 $wasdraft = 0;
1156                                 break;
1157                         case 'edit':
1158                         default:
1159                                 $publish = 1;
1160                                 $wasdraft = 0;
1161                                 $timestamp = 0;
1162                 }
1163
1164                 // edit the item for real
1165                 ITEM::update($itemid, $catid, $title, $body, $more, $closed, $wasdraft, $publish, $timestamp);
1166
1167                 if ($draftid > 0) {
1168                         ITEM::delete($draftid);
1169                 }
1170
1171                 $blogid = getBlogIDFromItemID($itemid);
1172                 $blog =& $manager->getBlog($blogid);
1173                 if (!$closed && $publish && $wasdraft && $blog->pingUserland()) {
1174                         $this->action_sendping($blogid);
1175                         return;
1176                 }
1177
1178                 // show category edit window when we created a new category
1179                 // ($catid will then be a new category ID, while postVar('catid') will be 'newcat-x')
1180                 if ($catid != intPostVar('catid')) {
1181                         $this->action_categoryedit(
1182                                 $catid,
1183                                 $blog->getID(),
1184                                 $CONF['AdminURL'] . 'index.php?action=itemlist&blogid=' . getBlogIDFromItemID($itemid)
1185                         );
1186                 } else {
1187                         // TODO: set start item correctly for itemlist
1188                         $this->action_itemlist(getBlogIDFromItemID($itemid));
1189                 }
1190         }
1191
1192         /**
1193          * @todo document this
1194          */
1195         function action_itemdelete() {
1196                 global $member, $manager;
1197
1198                 $itemid = intRequestVar('itemid');
1199
1200                 // only allow if user is allowed to alter item
1201                 $member->canAlterItem($itemid) or $this->disallow();
1202
1203                 if (!$manager->existsItem($itemid,1,1))
1204                         $this->error(_ERROR_NOSUCHITEM);
1205
1206                 $item =& $manager->getItem($itemid,1,1);
1207                 $title = htmlspecialchars(strip_tags($item['title']));
1208                 $body = strip_tags($item['body']);
1209                 $body = htmlspecialchars(shorten($body,300,'...'));
1210
1211                 $this->pagehead();
1212                 ?>
1213                         <h2><?php echo _DELETE_CONFIRM?></h2>
1214
1215                         <p><?php echo _CONFIRMTXT_ITEM?></p>
1216
1217                         <div class="note">
1218                                 <b>"<?php echo  $title ?>"</b>
1219                                 <br />
1220                                 <?php echo $body?>
1221                         </div>
1222
1223                         <form method="post" action="index.php"><div>
1224                                 <input type="hidden" name="action" value="itemdeleteconfirm" />
1225                                 <?php $manager->addTicketHidden() ?>
1226                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1227                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>"  tabindex="10" />
1228                         </div></form>
1229                 <?php
1230                 $this->pagefoot();
1231         }
1232
1233         /**
1234          * @todo document this
1235          */
1236         function action_itemdeleteconfirm() {
1237                 global $member;
1238
1239                 $itemid = intRequestVar('itemid');
1240
1241                 // only allow if user is allowed to alter item
1242                 $member->canAlterItem($itemid) or $this->disallow();
1243
1244                 // get blogid first
1245                 $blogid = getBlogIdFromItemId($itemid);
1246
1247                 // delete item (note: some checks will be performed twice)
1248                 $this->deleteOneItem($itemid);
1249
1250                 $this->action_itemlist($blogid);
1251         }
1252
1253         /**
1254          * Deletes one item and returns error if something goes wrong
1255          * @param int $itemid
1256          */
1257         function deleteOneItem($itemid) {
1258                 global $member, $manager;
1259
1260                 // only allow if user is allowed to alter item (also checks if itemid exists)
1261                 if (!$member->canAlterItem($itemid))
1262                         return _ERROR_DISALLOWED;
1263
1264                 $manager->loadClass('ITEM');
1265                 ITEM::delete($itemid);
1266         }
1267
1268         /**
1269          * @todo document this
1270          */
1271         function action_itemmove() {
1272                 global $member, $manager;
1273
1274                 $itemid = intRequestVar('itemid');
1275
1276                 // only allow if user is allowed to alter item
1277                 $member->canAlterItem($itemid) or $this->disallow();
1278
1279                 $item =& $manager->getItem($itemid,1,1);
1280
1281                 $this->pagehead();
1282                 ?>
1283                         <h2><?php echo _MOVE_TITLE?></h2>
1284                         <form method="post" action="index.php"><div>
1285                                 <input type="hidden" name="action" value="itemmoveto" />
1286                                 <input type="hidden" name="itemid" value="<?php echo  $itemid; ?>" />
1287
1288                                 <?php
1289
1290                                         $manager->addTicketHidden();
1291                                         $this->selectBlogCategory('catid',$item['catid'],10,1);
1292                                 ?>
1293
1294                                 <input type="submit" value="<?php echo _MOVE_BTN?>" tabindex="10000" onclick="return checkSubmit();" />
1295                         </div></form>
1296                 <?php
1297                 $this->pagefoot();
1298         }
1299
1300         /**
1301          * @todo document this
1302          */
1303         function action_itemmoveto() {
1304                 global $member, $manager;
1305
1306                 $itemid = intRequestVar('itemid');
1307                 $catid = requestVar('catid');
1308
1309                 // create new category if needed
1310                 if (strstr($catid,'newcat')) {
1311                         // get blogid
1312                         list($blogid) = sscanf($catid,'newcat-%d');
1313
1314                         // create
1315                         $blog =& $manager->getBlog($blogid);
1316                         $catid = $blog->createNewCategory();
1317
1318                         // show error when sth goes wrong
1319                         if (!$catid)
1320                                 $this->doError(_ERROR_CATCREATEFAIL);
1321                 }
1322
1323                 // only allow if user is allowed to alter item
1324                 $member->canUpdateItem($itemid, $catid) or $this->disallow();
1325
1326                 ITEM::move($itemid, $catid);
1327
1328                 if ($catid != intRequestVar('catid'))
1329                         $this->action_categoryedit($catid, $blog->getID());
1330                 else
1331                         $this->action_itemlist(getBlogIDFromCatID($catid));
1332         }
1333
1334         /**
1335          * Moves one item to a given category (category existance should be checked by caller)
1336          * errors are returned
1337          * @param int $itemid
1338          * @param int $destCatid category ID to which the item will be moved
1339          */
1340         function moveOneItem($itemid, $destCatid) {
1341                 global $member;
1342
1343                 // only allow if user is allowed to move item
1344                 if (!$member->canUpdateItem($itemid, $destCatid))
1345                         return _ERROR_DISALLOWED;
1346
1347                 ITEM::move($itemid, $destCatid);
1348         }
1349
1350         /**
1351          * Adds a item to the chosen blog
1352          */
1353         function action_additem() {
1354                 global $member, $manager, $CONF;
1355
1356                 $manager->loadClass('ITEM');
1357
1358                 $result = ITEM::createFromRequest();
1359
1360                 if ($result['status'] == 'error')
1361                         $this->error($result['message']);
1362
1363                 $blogid = getBlogIDFromItemID($result['itemid']);
1364                 $blog =& $manager->getBlog($blogid);
1365
1366                 $pingUrl = $manager->addTicketToUrl($CONF['AdminURL'] . 'index.php?action=sendping&blogid=' . intval($blogid));
1367
1368                 if ($result['status'] == 'newcategory')
1369                         $this->action_categoryedit(
1370                                 $result['catid'],
1371                                 $blogid,
1372                                 $blog->pingUserland() ? $pingUrl : ''
1373                         );
1374                 elseif ((postVar('actiontype') == 'addnow') && $blog->pingUserland())
1375                         $this->action_sendping($blogid);
1376                 else
1377                         $this->action_itemlist($blogid);
1378         }
1379
1380         /**
1381          * Shows a window that says we're about to ping weblogs.com.
1382          * immediately refresh to the real pinging page, which will
1383          * show an error, or redirect to the blog.
1384          *
1385          * @param int $blogid ID of blog for which ping needs to be sent out
1386          */
1387         function action_sendping($blogid = -1) {
1388                 global $member, $manager;
1389
1390                 if ($blogid == -1)
1391                         $blogid = intRequestVar('blogid');
1392
1393                 $member->isLoggedIn() or $this->disallow();
1394
1395                 $rawPingUrl = $manager->addTicketToUrl('index.php?action=rawping&blogid=' . intval($blogid));
1396
1397                 $this->pagehead('<meta http-equiv="refresh" content="1; url='.htmlspecialchars($rawPingUrl).'" />');
1398                 ?>
1399                 <h2>Site Updated, Now pinging weblogs.com</h2>
1400
1401                 <p>
1402                         Pinging weblogs.com! This can a while...
1403                         <br />
1404                         When the ping is complete (and successfull), your weblog will show up in the weblogs.com updates list.
1405                 </p>
1406
1407                 <p>
1408                         If you aren't automatically passed through, <a href="index.php?action=rawping&amp;blogid=<?php echo $blogid?>">try again</a>
1409                 </p>
1410                 <?php           $this->pagefoot();
1411         }
1412
1413         /**
1414          * Ping to Weblogs.com
1415          * Sends the real ping (can take up to 10 seconds!)
1416          */
1417         function action_rawping() {
1418                 global $manager;
1419                 // TODO: checks?
1420
1421                 $blogid = intRequestVar('blogid');
1422                 $blog =& $manager->getBlog($blogid);
1423
1424                 $result = $blog->sendUserlandPing();
1425
1426                 $this->pagehead();
1427
1428                 ?>
1429
1430                 <h2>Ping Results</h2>
1431
1432                 <p>The following message was returned by weblogs.com:</p>
1433
1434                 <div class='note'><?php echo  $result ?></div>
1435
1436                 <ul>
1437                         <li><a href="index.php?action=itemlist&amp;blogid=<?php echo $blog->getID()?>">View list of recent items for <?php echo htmlspecialchars($blog->getName())?></a></li>
1438                         <li><a href="<?php echo $blog->getURL()?>">Visit your own site</a></li>
1439                 </ul>
1440
1441                 <?php           $this->pagefoot();
1442         }
1443
1444         /**
1445          * Allows to edit previously made comments
1446          */
1447         function action_commentedit() {
1448                 global $member, $manager;
1449
1450                 $commentid = intRequestVar('commentid');
1451
1452                 $member->canAlterComment($commentid) or $this->disallow();
1453
1454                 $comment = COMMENT::getComment($commentid);
1455
1456                 $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
1457
1458                 // change <br /> to \n
1459                 $comment['body'] = str_replace('<br />','',$comment['body']);
1460
1461                 $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
1462
1463                 $this->pagehead();
1464
1465                 ?>
1466                 <h2><?php echo _EDITC_TITLE?></h2>
1467
1468                 <form action="index.php" method="post"><div>
1469
1470                 <input type="hidden" name="action" value="commentupdate" />
1471                 <?php $manager->addTicketHidden(); ?>
1472                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1473                 <table><tr>
1474                         <th colspan="2"><?php echo _EDITC_TITLE?></th>
1475                 </tr><tr>
1476                         <td><?php echo _EDITC_WHO?></td>
1477                         <td>
1478                         <?php                           if ($comment['member'])
1479                                         echo $comment['member'] . " (" . _EDITC_MEMBER . ")";
1480                                 else
1481                                         echo $comment['user'] . " (" . _EDITC_NONMEMBER . ")";
1482                         ?>
1483                         </td>
1484                 </tr><tr>
1485                         <td><?php echo _EDITC_WHEN?></td>
1486                         <td><?php echo  date("Y-m-d @ H:i",$comment['timestamp']); ?></td>
1487                 </tr><tr>
1488                         <td><?php echo _EDITC_HOST?></td>
1489                         <td><?php echo  $comment['host']; ?></td>
1490                 </tr><tr>
1491                         <td><?php echo _EDITC_TEXT?></td>
1492                         <td>
1493                                 <textarea name="body" tabindex="10" rows="10" cols="50"><?php                                   // htmlspecialchars not needed (things should be escaped already)
1494                                         echo $comment['body'];
1495                                 ?></textarea>
1496                         </td>
1497                 </tr><tr>
1498                         <td><?php echo _EDITC_EDIT?></td>
1499                         <td><input type="submit"  tabindex="20" value="<?php echo _EDITC_EDIT?>" onclick="return checkSubmit();" /></td>
1500                 </tr></table>
1501
1502                 </div></form>
1503                 <?php
1504                 $this->pagefoot();
1505         }
1506
1507         /**
1508          * @todo document this
1509          */
1510         function action_commentupdate() {
1511                 global $member, $manager;
1512
1513                 $commentid = intRequestVar('commentid');
1514
1515                 $member->canAlterComment($commentid) or $this->disallow();
1516
1517                 $body = postVar('body');
1518
1519                 // intercept words that are too long
1520                 if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
1521                         $this->error(_ERROR_COMMENT_LONGWORD);
1522
1523                 // check length
1524                 if (strlen($body)<3)
1525                         $this->error(_ERROR_COMMENT_NOCOMMENT);
1526                 if (strlen($body)>5000)
1527                         $this->error(_ERROR_COMMENT_TOOLONG);
1528
1529
1530                 // prepare body
1531                 $body = COMMENT::prepareBody($body);
1532
1533                 // call plugins
1534                 $manager->notify('PreUpdateComment',array('body' => &$body));
1535
1536                 $query =  'UPDATE '.sql_table('comment')
1537                            . " SET cbody='" .addslashes($body). "'"
1538                            . " WHERE cnumber=" . $commentid;
1539                 sql_query($query);
1540
1541                 // get itemid
1542                 $res = sql_query('SELECT citem FROM '.sql_table('comment').' WHERE cnumber=' . $commentid);
1543                 $o = mysql_fetch_object($res);
1544                 $itemid = $o->citem;
1545
1546                 if ($member->canAlterItem($itemid))
1547                         $this->action_itemcommentlist($itemid);
1548                 else
1549                         $this->action_browseowncomments();
1550
1551         }
1552
1553         /**
1554          * @todo document this
1555          */
1556         function action_commentdelete() {
1557                 global $member, $manager;
1558
1559                 $commentid = intRequestVar('commentid');
1560
1561                 $member->canAlterComment($commentid) or $this->disallow();
1562
1563                 $comment = COMMENT::getComment($commentid);
1564
1565                 $body = strip_tags($comment['body']);
1566                 $body = htmlspecialchars(shorten($body, 300, '...'));
1567
1568                 if ($comment['member'])
1569                         $author = $comment['member'];
1570                 else
1571                         $author = $comment['user'];
1572
1573                 $this->pagehead();
1574                 ?>
1575
1576                         <h2><?php echo _DELETE_CONFIRM?></h2>
1577
1578                         <p><?php echo _CONFIRMTXT_COMMENT?></p>
1579
1580                         <div class="note">
1581                         <b><?php echo _EDITC_WHO?>:</b> <?php echo  $author ?>
1582                         <br />
1583                         <b><?php echo _EDITC_TEXT?>:</b> <?php echo  $body ?>
1584                         </div>
1585
1586                         <form method="post" action="index.php"><div>
1587                                 <input type="hidden" name="action" value="commentdeleteconfirm" />
1588                                 <?php $manager->addTicketHidden() ?>
1589                                 <input type="hidden" name="commentid" value="<?php echo  $commentid; ?>" />
1590                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
1591                         </div></form>
1592                 <?php
1593                 $this->pagefoot();
1594         }
1595
1596         /**
1597          * @todo document this
1598          */
1599         function action_commentdeleteconfirm() {
1600                 global $member;
1601
1602                 $commentid = intRequestVar('commentid');
1603
1604                 // get item id first
1605                 $res = sql_query('SELECT citem FROM '.sql_table('comment') .' WHERE cnumber=' . $commentid);
1606                 $o = mysql_fetch_object($res);
1607                 $itemid = $o->citem;
1608
1609                 $error = $this->deleteOneComment($commentid);
1610                 if ($error)
1611                         $this->doError($error);
1612
1613                 if ($member->canAlterItem($itemid))
1614                         $this->action_itemcommentlist($itemid);
1615                 else
1616                         $this->action_browseowncomments();
1617         }
1618
1619         /**
1620          * @todo document this
1621          */
1622         function deleteOneComment($commentid) {
1623                 global $member, $manager;
1624
1625                 $commentid = intval($commentid);
1626
1627                 if (!$member->canAlterComment($commentid))
1628                         return _ERROR_DISALLOWED;
1629
1630                 $manager->notify('PreDeleteComment', array('commentid' => $commentid));
1631
1632                 // delete the comments associated with the item
1633                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cnumber=' . $commentid;
1634                 sql_query($query);
1635
1636                 $manager->notify('PostDeleteComment', array('commentid' => $commentid));
1637
1638                 return '';
1639         }
1640
1641         /**
1642          * Usermanagement main
1643          */
1644         function action_usermanagement() {
1645                 global $member, $manager;
1646
1647                 // check if allowed
1648                 $member->isAdmin() or $this->disallow();
1649
1650                 $this->pagehead();
1651
1652                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
1653
1654                 echo '<h2>' . _MEMBERS_TITLE .'</h2>';
1655
1656                 echo '<h3>' . _MEMBERS_CURRENT .'</h3>';
1657
1658                 // show list of members with actions
1659                 $query =  'SELECT *'
1660                            . ' FROM '.sql_table('member');
1661                 $template['content'] = 'memberlist';
1662                 $template['tabindex'] = 10;
1663
1664                 $manager->loadClass("ENCAPSULATE");
1665                 $batch =& new BATCH('member');
1666                 $batch->showlist($query,'table',$template);
1667
1668                 echo '<h3>' . _MEMBERS_NEW .'</h3>';
1669                 ?>
1670                         <form method="post" action="index.php"><div>
1671
1672                         <input type="hidden" name="action" value="memberadd" />
1673                         <?php $manager->addTicketHidden() ?>
1674
1675                         <table>
1676                         <tr>
1677                                 <th colspan="2"><?php echo _MEMBERS_NEW?></th>
1678                         </tr><tr>
1679                                 <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1680                                         <br /><small>(This is the name used to logon)</small>
1681                                 </td>
1682                                 <td><input tabindex="10010" name="name" size="16" maxlength="16" /></td>
1683                         </tr><tr>
1684                                 <td><?php echo _MEMBERS_REALNAME?></td>
1685                                 <td><input name="realname" tabindex="10020" size="40" maxlength="60" /></td>
1686                         </tr><tr>
1687                                 <td><?php echo _MEMBERS_PWD?></td>
1688                                 <td><input name="password" tabindex="10030" size="16" maxlength="40" type="password" /></td>
1689                         </tr><tr>
1690                                 <td><?php echo _MEMBERS_REPPWD?></td>
1691                                 <td><input name="repeatpassword" tabindex="10035" size="16" maxlength="40" type="password" /></td>
1692                         </tr><tr>
1693                                 <td><?php echo _MEMBERS_EMAIL?></td>
1694                                 <td><input name="email" tabindex="10040" size="40" maxlength="60" /></td>
1695                         </tr><tr>
1696                                 <td><?php echo _MEMBERS_URL?></td>
1697                                 <td><input name="url" tabindex="10050" size="40" maxlength="100" /></td>
1698                         </tr><tr>
1699                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1700                                 <td><?php $this->input_yesno('admin',0,10060); ?> </td>
1701                         </tr><tr>
1702                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1703                                 <td><?php $this->input_yesno('canlogin',1,10070); ?></td>
1704                         </tr><tr>
1705                                 <td><?php echo _MEMBERS_NOTES?></td>
1706                                 <td><input name="notes" maxlength="100" size="40" tabindex="10080" /></td>
1707                         </tr><tr>
1708                                 <td><?php echo _MEMBERS_NEW?></td>
1709                                 <td><input type="submit" value="<?php echo _MEMBERS_NEW_BTN?>" tabindex="10090" onclick="return checkSubmit();" /></td>
1710                         </tr></table>
1711
1712                         </div></form>
1713                 <?php
1714                 $this->pagefoot();
1715         }
1716
1717         /**
1718          * Edit member settings
1719          */
1720         function action_memberedit() {
1721                 $this->action_editmembersettings(intRequestVar('memberid'));
1722         }
1723
1724         /**
1725          * @todo document this
1726          */
1727         function action_editmembersettings($memberid = '') {
1728                 global $member, $manager, $CONF;
1729
1730                 if ($memberid == '')
1731                         $memberid = $member->getID();
1732
1733                 // check if allowed
1734                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1735
1736                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
1737                 $this->pagehead($extrahead);
1738
1739                 // show message to go back to member overview (only for admins)
1740                 if ($member->isAdmin())
1741                         echo '<a href="index.php?action=usermanagement">(' ._MEMBERS_BACKTOOVERVIEW. ')</a>';
1742                 else
1743                         echo '<a href="index.php?action=overview">(' ._BACKHOME. ')</a>';
1744
1745                 echo '<h2>' . _MEMBERS_EDIT . '</h2>';
1746
1747                 $mem = MEMBER::createFromID($memberid);
1748
1749                 ?>
1750                 <form method="post" action="index.php"><div>
1751
1752                 <input type="hidden" name="action" value="changemembersettings" />
1753                 <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
1754                 <?php $manager->addTicketHidden() ?>
1755
1756                 <table><tr>
1757                         <th colspan="2"><?php echo _MEMBERS_EDIT?></th>
1758                 </tr><tr>
1759                         <td><?php echo _MEMBERS_DISPLAY?> <?php help('shortnames');?>
1760                                 <br /><small><?php echo _MEMBERS_DISPLAY_INFO?></small>
1761                         </td>
1762                         <td>
1763                         <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1764                                 <input name="name" tabindex="10" maxlength="16" size="16" value="<?php echo  htmlspecialchars($mem->getDisplayName()); ?>" />
1765                         <?php } else {
1766                                 echo htmlspecialchars($member->getDisplayName());
1767                            }
1768                         ?>
1769                         </td>
1770                 </tr><tr>
1771                         <td><?php echo _MEMBERS_REALNAME?></td>
1772                         <td><input name="realname" tabindex="20" maxlength="60" size="40" value="<?php echo  htmlspecialchars($mem->getRealName()); ?>" /></td>
1773                 </tr><tr>
1774                 <?php if ($CONF['AllowLoginEdit'] || $member->isAdmin()) { ?>
1775                         <td><?php echo _MEMBERS_PWD?></td>
1776                         <td><input type="password" tabindex="30" maxlength="40" size="16" name="password" /></td>
1777                 </tr><tr>
1778                         <td><?php echo _MEMBERS_REPPWD?></td>
1779                         <td><input type="password" tabindex="35" maxlength="40" size="16" name="repeatpassword" /></td>
1780                 <?php } ?>
1781                 </tr><tr>
1782                         <td><?php echo _MEMBERS_EMAIL?>
1783                                 <br /><small><?php echo _MEMBERS_EMAIL_EDIT?></small>
1784                         </td>
1785                         <td><input name="email" tabindex="40" size="40" maxlength="60" value="<?php echo  htmlspecialchars($mem->getEmail()); ?>" /></td>
1786                 </tr><tr>
1787                         <td><?php echo _MEMBERS_URL?></td>
1788                         <td><input name="url" tabindex="50" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getURL()); ?>" /></td>
1789                 <?php // only allow to change this by super-admins
1790                    // we don't want normal users to 'upgrade' themselves to super-admins, do we? ;-)
1791                    if ($member->isAdmin()) {
1792                 ?>
1793                         </tr><tr>
1794                                 <td><?php echo _MEMBERS_SUPERADMIN?> <?php help('superadmin'); ?></td>
1795                                 <td><?php $this->input_yesno('admin',$mem->isAdmin(),60); ?></td>
1796                         </tr><tr>
1797                                 <td><?php echo _MEMBERS_CANLOGIN?> <?php help('canlogin'); ?></td>
1798                                 <td><?php $this->input_yesno('canlogin',$mem->canLogin(),70); ?></td>
1799                 <?php } ?>
1800                 </tr><tr>
1801                         <td><?php echo _MEMBERS_NOTES?></td>
1802                         <td><input name="notes" tabindex="80" size="40" maxlength="100" value="<?php echo  htmlspecialchars($mem->getNotes()); ?>" /></td>
1803                 </tr><tr>
1804                         <td><?php echo _MEMBERS_DEFLANG?> <?php help('language'); ?>
1805                         </td>
1806                         <td>
1807
1808                                 <select name="deflang" tabindex="85">
1809                                         <option value=""><?php echo _MEMBERS_USESITELANG?></option>
1810                                 <?php                           // show a dropdown list of all available languages
1811                                 global $DIR_LANG;
1812                                 $dirhandle = opendir($DIR_LANG);
1813                                 while ($filename = readdir($dirhandle)) {
1814                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
1815                                                 $name = $matches[1];
1816                                                 echo "<option value='$name'";
1817                                                 if ($name == $mem->getLanguage())
1818                                                         echo " selected='selected'";
1819                                                 echo ">$name</option>";
1820                                         }
1821                                 }
1822                                 closedir($dirhandle);
1823
1824                                 ?>
1825                                 </select>
1826
1827                         </td>
1828                 </tr>
1829                 <?php
1830                         // plugin options
1831                         $this->_insertPluginOptions('member',$memberid);
1832                 ?>
1833                 <tr>
1834                         <th colspan="2"><?php echo _MEMBERS_EDIT ?></th>
1835                 </tr><tr>
1836                         <td><?php echo _MEMBERS_EDIT?></td>
1837                         <td><input type="submit" tabindex="90" value="<?php echo _MEMBERS_EDIT_BTN?>" onclick="return checkSubmit();" /></td>
1838                 </tr></table>
1839
1840                 </div></form>
1841
1842                 <?php
1843                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
1844
1845                         $manager->notify(
1846                                 'MemberSettingsFormExtras',
1847                                 array(
1848                                         'member' => &$mem
1849                                 )
1850                         );
1851
1852                 $this->pagefoot();
1853         }
1854
1855         /**
1856          * @todo document this
1857          */
1858         function action_changemembersettings() {
1859                 global $member, $CONF, $manager;
1860
1861                 $memberid = intRequestVar('memberid');
1862
1863                 // check if allowed
1864                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
1865
1866                 $name                   = trim(postVar('name'));
1867                 $realname               = trim(postVar('realname'));
1868                 $password               = postVar('password');
1869                 $repeatpassword = postVar('repeatpassword');
1870                 $email                  = postVar('email');
1871                 $url                    = postVar('url');
1872
1873                 // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
1874                 if (!eregi("^https?://", $url))
1875                         $url = "http://".$url;
1876
1877                 $admin                  = postVar('admin');
1878                 $canlogin               = postVar('canlogin');
1879                 $notes                  = postVar('notes');
1880                 $deflang                = postVar('deflang');
1881
1882                 $mem = MEMBER::createFromID($memberid);
1883
1884                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1885
1886                         if (!isValidDisplayName($name))
1887                                 $this->error(_ERROR_BADNAME);
1888
1889                         if (($name != $mem->getDisplayName()) && MEMBER::exists($name))
1890                                 $this->error(_ERROR_NICKNAMEINUSE);
1891
1892                         if ($password != $repeatpassword)
1893                                 $this->error(_ERROR_PASSWORDMISMATCH);
1894
1895                         if ($password && (strlen($password) < 6))
1896                                 $this->error(_ERROR_PASSWORDTOOSHORT);
1897                 }
1898
1899                 if (!isValidMailAddress($email))
1900                         $this->error(_ERROR_BADMAILADDRESS);
1901
1902
1903                 if (!$realname)
1904                         $this->error(_ERROR_REALNAMEMISSING);
1905
1906                 if (($deflang != '') && (!checkLanguage($deflang)))
1907                         $this->error(_ERROR_NOSUCHLANGUAGE);
1908
1909                 // check if there will remain at least one site member with both the logon and admin rights
1910                 // (check occurs when taking away one of these rights from such a member)
1911                 if (    (!$admin && $mem->isAdmin() && $mem->canLogin())
1912                          || (!$canlogin && $mem->isAdmin() && $mem->canLogin())
1913                    )
1914                 {
1915                         $r = sql_query('SELECT * FROM '.sql_table('member').' WHERE madmin=1 and mcanlogin=1');
1916                         if (mysql_num_rows($r) < 2)
1917                                 $this->error(_ERROR_ATLEASTONEADMIN);
1918                 }
1919
1920                 if ($CONF['AllowLoginEdit'] || $member->isAdmin()) {
1921                         $mem->setDisplayName($name);
1922                         if ($password)
1923                                 $mem->setPassword($password);
1924                 }
1925
1926                 if ($newpass)
1927                         $mem->setPassword($password);
1928
1929                 $oldEmail = $mem->getEmail();
1930
1931                 $mem->setRealName($realname);
1932                 $mem->setEmail($email);
1933                 $mem->setURL($url);
1934                 $mem->setNotes($notes);
1935                 $mem->setLanguage($deflang);
1936
1937
1938                 // only allow super-admins to make changes to the admin status
1939                 if ($member->isAdmin()) {
1940                         $mem->setAdmin($admin);
1941                         $mem->setCanLogin($canlogin);
1942                 }
1943
1944
1945                 $mem->write();
1946
1947                 // store plugin options
1948                 $aOptions = requestArray('plugoption');
1949                 NucleusPlugin::_applyPluginOptions($aOptions);
1950                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'member', 'memberid' => $memberid, 'member' => &$mem));
1951
1952                 // if email changed, generate new password
1953                 if ($oldEmail != $mem->getEmail())
1954                 {
1955                         $mem->sendActivationLink('addresschange', $oldEmail);
1956                         // logout member
1957                         $mem->newCookieKey();
1958
1959                         // only log out if the member being edited is the current member.
1960                         if ($member->getID() == $memberid)
1961                                 $member->logout();
1962                         $this->action_login(_MSG_ACTIVATION_SENT, 0);
1963                         return;
1964                 }
1965
1966
1967                 if (  ( $mem->getID() == $member->getID() )
1968                    && ( $newpass || ( $mem->getDisplayName() != $member->getDisplayName() ) )
1969                    ) {
1970                         $mem->newCookieKey();
1971                         $member->logout();
1972                         $this->action_login(_MSG_LOGINAGAIN, 0);
1973                 } else {
1974                         $this->action_overview(_MSG_SETTINGSCHANGED);
1975                 }
1976         }
1977
1978         /**
1979          * @todo document this
1980          */
1981         function action_memberadd() {
1982                 global $member, $manager;
1983
1984                 // check if allowed
1985                 $member->isAdmin() or $this->disallow();
1986
1987                 if (postVar('password') != postVar('repeatpassword'))
1988                         $this->error(_ERROR_PASSWORDMISMATCH);
1989                 if (strlen(postVar('password')) < 6)
1990                         $this->error(_ERROR_PASSWORDTOOSHORT);
1991
1992                 $res = MEMBER::create(postVar('name'), postVar('realname'), postVar('password'), postVar('email'), postVar('url'), postVar('admin'), postVar('canlogin'), postVar('notes'));
1993                 if ($res != 1)
1994                         $this->error($res);
1995
1996                 // fire PostRegister event
1997                 $newmem = new MEMBER();
1998                 $newmem->readFromName(postVar('name'));
1999                 $manager->notify('PostRegister',array('member' => &$newmem));
2000
2001                 $this->action_usermanagement();
2002         }
2003
2004         /**
2005          * Account activation
2006          *
2007          * @author dekarma
2008          */
2009         function action_activate() {
2010
2011                 $key = getVar('key');
2012                 $this->_showActivationPage($key);
2013         }
2014
2015         /**
2016          * @todo document this
2017          */
2018         function _showActivationPage($key, $message = '')
2019         {
2020                 global $manager;
2021
2022                 // clean up old activation keys
2023                 MEMBER::cleanupActivationTable();
2024
2025                 // get activation info
2026                 $info = MEMBER::getActivationInfo($key);
2027
2028                 if (!$info)
2029                         $this->error(_ERROR_ACTIVATE);
2030
2031                 $mem = MEMBER::createFromId($info->vmember);
2032
2033                 if (!$mem)
2034                         $this->error(_ERROR_ACTIVATE);
2035
2036                 $text = '';
2037                 $title = '';
2038                 $bNeedsPasswordChange = true;
2039
2040                 switch ($info->vtype)
2041                 {
2042                         case 'forgot':
2043                                 $title = _ACTIVATE_FORGOT_TITLE;
2044                                 $text = _ACTIVATE_FORGOT_TEXT;
2045                                 break;
2046                         case 'register':
2047                                 $title = _ACTIVATE_REGISTER_TITLE;
2048                                 $text = _ACTIVATE_REGISTER_TEXT;
2049                                 break;
2050                         case 'addresschange':
2051                                 $title = _ACTIVATE_CHANGE_TITLE;
2052                                 $text = _ACTIVATE_CHANGE_TEXT;
2053                                 $bNeedsPasswordChange = false;
2054                                 MEMBER::activate($key);
2055                                 break;
2056                 }
2057
2058                 $aVars = array(
2059                         'memberName' => htmlspecialchars($mem->getDisplayName())
2060                 );
2061                 $title = TEMPLATE::fill($title, $aVars);
2062                 $text = TEMPLATE::fill($text, $aVars);
2063
2064                 $this->pagehead();
2065
2066                         echo '<h2>' , $title, '</h2>';
2067                         echo '<p>' , $text, '</p>';
2068
2069                         if ($message != '')
2070                         {
2071                                 echo '<p class="error">',$message,'</p>';
2072                         }
2073
2074                         if ($bNeedsPasswordChange)
2075                         {
2076                                 ?>
2077                                         <div><form action="index.php" method="post">
2078
2079                                                 <input type="hidden" name="action" value="activatesetpwd" />
2080                                                 <?php $manager->addTicketHidden() ?>
2081                                                 <input type="hidden" name="key" value="<?php echo htmlspecialchars($key) ?>" />
2082
2083                                                 <table><tr>
2084                                                         <td><?php echo _MEMBERS_PWD?></td>
2085                                                         <td><input type="password" maxlength="40" size="16" name="password" /></td>
2086                                                 </tr><tr>
2087                                                         <td><?php echo _MEMBERS_REPPWD?></td>
2088                                                         <td><input type="password" maxlength="40" size="16" name="repeatpassword" /></td>
2089                                                 <?php
2090
2091                                                         global $manager;
2092                                                         $manager->notify('FormExtra', array('type' => 'activation', 'member' => $mem));
2093
2094                                                 ?>
2095                                                 </tr><tr>
2096                                                         <td><?php echo _MEMBERS_SETPWD ?></td>
2097                                                         <td><input type='submit' value='<?php echo _MEMBERS_SETPWD_BTN ?>' /></td>
2098                                                 </tr></table>
2099
2100
2101                                         </form></div>
2102
2103                                 <?php
2104
2105                         }
2106
2107                 $this->pagefoot();
2108
2109         }
2110
2111         /**
2112          * Account activation - set password part
2113          *
2114          * @author dekarma
2115          */
2116         function action_activatesetpwd() {
2117
2118                 $key = postVar('key');
2119
2120                 // clean up old activation keys
2121                 MEMBER::cleanupActivationTable();
2122
2123                 // get activation info
2124                 $info = MEMBER::getActivationInfo($key);
2125
2126                 if (!$info || ($info->type == 'addresschange'))
2127                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2128
2129                 $mem = MEMBER::createFromId($info->vmember);
2130
2131                 if (!$mem)
2132                         return $this->_showActivationPage($key, _ERROR_ACTIVATE);
2133
2134                 $password               = postVar('password');
2135                 $repeatpassword = postVar('repeatpassword');
2136
2137                 if ($password != $repeatpassword)
2138                         return $this->_showActivationPage($key, _ERROR_PASSWORDMISMATCH);
2139
2140                 if ($password && (strlen($password) < 6))
2141                         return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
2142
2143                 $error = '';
2144                 global $manager;
2145                 $manager->notify('ValidateForm', array('type' => 'activation', 'member' => $mem, 'error' => &$error));
2146                 if ($error != '')
2147                         return $this->_showActivationPage($key, $error);
2148
2149
2150                 // set password
2151                 $mem->setPassword($password);
2152                 $mem->write();
2153
2154                 // do the activation
2155                 MEMBER::activate($key);
2156
2157                 $this->pagehead();
2158                         echo '<h2>',_ACTIVATE_SUCCESS_TITLE,'</h2>';
2159                         echo '<p>',_ACTIVATE_SUCCESS_TEXT,'</p>';
2160                 $this->pagefoot();
2161         }
2162
2163         /**
2164          * Manage team
2165          */
2166         function action_manageteam() {
2167                 global $member, $manager;
2168
2169                 $blogid = intRequestVar('blogid');
2170
2171                 // check if allowed
2172                 $member->blogAdminRights($blogid) or $this->disallow();
2173
2174                 $this->pagehead();
2175
2176                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2177
2178                 echo '<h2>' . _TEAM_TITLE . getBlogNameFromID($blogid) . '</h2>';
2179
2180                 echo '<h3>' . _TEAM_CURRENT . '</h3>';
2181
2182
2183
2184                 $query =  'SELECT tblog, tmember, mname, mrealname, memail, tadmin'
2185                            . ' FROM '.sql_table('member').', '.sql_table('team')
2186                            . ' WHERE tmember=mnumber and tblog=' . $blogid;
2187
2188                 $template['content'] = 'teamlist';
2189                 $template['tabindex'] = 10;
2190
2191                 $manager->loadClass("ENCAPSULATE");
2192                 $batch =& new BATCH('team');
2193                 $batch->showlist($query, 'table', $template);
2194
2195                 ?>
2196                         <h3><?php echo _TEAM_ADDNEW?></h3>
2197
2198                         <form method='post' action='index.php'><div>
2199
2200                         <input type='hidden' name='action' value='teamaddmember' />
2201                         <input type='hidden' name='blogid' value='<?php echo  $blogid; ?>' />
2202                         <?php $manager->addTicketHidden() ?>
2203
2204                         <table><tr>
2205                                 <td><?php echo _TEAM_CHOOSEMEMBER?></td>
2206                                 <td><?php                                       // TODO: try to make it so only non-team-members are listed
2207                                         $query =  'SELECT mname as text, mnumber as value'
2208                                                    . ' FROM '.sql_table('member');
2209
2210                                         $template['name'] = 'memberid';
2211                                         $template['tabindex'] = 10000;
2212                                         showlist($query,'select',$template);
2213                                 ?></td>
2214                         </tr><tr>
2215                                 <td><?php echo _TEAM_ADMIN?><?php help('teamadmin'); ?></td>
2216                                 <td><?php $this->input_yesno('admin',0,10020); ?></td>
2217                         </tr><tr>
2218                                 <td><?php echo _TEAM_ADD?></td>
2219                                 <td><input type='submit' value='<?php echo _TEAM_ADD_BTN?>' tabindex="10030" /></td>
2220                         </tr></table>
2221
2222                         </div></form>
2223                 <?php
2224                 $this->pagefoot();
2225         }
2226
2227         /**
2228          * Add member to team
2229          */
2230         function action_teamaddmember() {
2231                 global $member, $manager;
2232
2233                 $memberid = intPostVar('memberid');
2234                 $blogid = intPostVar('blogid');
2235                 $admin = intPostVar('admin');
2236
2237                 // check if allowed
2238                 $member->blogAdminRights($blogid) or $this->disallow();
2239
2240                 $blog =& $manager->getBlog($blogid);
2241                 if (!$blog->addTeamMember($memberid, $admin))
2242                         $this->error(_ERROR_ALREADYONTEAM);
2243
2244                 $this->action_manageteam();
2245
2246         }
2247
2248         /**
2249          * @todo document this
2250          */
2251         function action_teamdelete() {
2252                 global $member, $manager;
2253
2254                 $memberid = intRequestVar('memberid');
2255                 $blogid = intRequestVar('blogid');
2256
2257                 // check if allowed
2258                 $member->blogAdminRights($blogid) or $this->disallow();
2259
2260                 $teammem = MEMBER::createFromID($memberid);
2261                 $blog =& $manager->getBlog($blogid);
2262
2263                 $this->pagehead();
2264                 ?>
2265                         <h2><?php echo _DELETE_CONFIRM?></h2>
2266
2267                         <p><?php echo _CONFIRMTXT_TEAM1?><b><?php echo  $teammem->getDisplayName() ?></b><?php echo _CONFIRMTXT_TEAM2?><b><?php echo  htmlspecialchars(strip_tags($blog->getName())) ?></b>
2268                         </p>
2269
2270
2271                         <form method="post" action="index.php"><div>
2272                         <input type="hidden" name="action" value="teamdeleteconfirm" />
2273                         <?php $manager->addTicketHidden() ?>
2274                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
2275                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2276                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2277                         </div></form>
2278                 <?php
2279                 $this->pagefoot();
2280         }
2281
2282         /**
2283          * @todo document this
2284          */
2285         function action_teamdeleteconfirm() {
2286                 global $member;
2287
2288                 $memberid = intRequestVar('memberid');
2289                 $blogid = intRequestVar('blogid');
2290
2291                 $error = $this->deleteOneTeamMember($blogid, $memberid);
2292                 if ($error)
2293                         $this->error($error);
2294
2295
2296                 $this->action_manageteam();
2297         }
2298
2299         /**
2300          * @todo document this
2301          */
2302         function deleteOneTeamMember($blogid, $memberid) {
2303                 global $member, $manager;
2304
2305                 $blogid = intval($blogid);
2306                 $memberid = intval($memberid);
2307
2308                 // check if allowed
2309                 if (!$member->blogAdminRights($blogid))
2310                         return _ERROR_DISALLOWED;
2311
2312                 // check if: - there remains at least one blog admin
2313                 //           - (there remains at least one team member)
2314                 $tmem = MEMBER::createFromID($memberid);
2315
2316                 $manager->notify('PreDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2317
2318                 if ($tmem->isBlogAdmin($blogid)) {
2319                         // check if there are more blog members left and at least one admin
2320                         // (check for at least two admins before deletion)
2321                         $query = 'SELECT * FROM '.sql_table('team') . ' WHERE tblog='.$blogid.' and tadmin=1';
2322                         $r = sql_query($query);
2323                         if (mysql_num_rows($r) < 2)
2324                                 return _ERROR_ATLEASTONEBLOGADMIN;
2325                 }
2326
2327                 $query = 'DELETE FROM '.sql_table('team')." WHERE tblog=$blogid and tmember=$memberid";
2328                 sql_query($query);
2329
2330                 $manager->notify('PostDeleteTeamMember', array('member' => &$mem, 'blogid' => $blogid));
2331
2332                 return '';
2333         }
2334
2335         /**
2336          * @todo document this
2337          */
2338         function action_teamchangeadmin() {
2339                 global $member;
2340
2341                 $blogid = intRequestVar('blogid');
2342                 $memberid = intRequestVar('memberid');
2343
2344                 // check if allowed
2345                 $member->blogAdminRights($blogid) or $this->disallow();
2346
2347                 $mem = MEMBER::createFromID($memberid);
2348
2349                 // don't allow when there is only one admin at this moment
2350                 if ($mem->isBlogAdmin($blogid)) {
2351                         $r = sql_query('SELECT * FROM '.sql_table('team') . " WHERE tblog=$blogid and tadmin=1");
2352                         if (mysql_num_rows($r) == 1)
2353                                 $this->error(_ERROR_ATLEASTONEBLOGADMIN);
2354                 }
2355
2356                 if ($mem->isBlogAdmin($blogid))
2357                         $newval = 0;
2358                 else
2359                         $newval = 1;
2360
2361                 $query = 'UPDATE '.sql_table('team') ." SET tadmin=$newval WHERE tblog=$blogid and tmember=$memberid";
2362                 sql_query($query);
2363
2364                 // only show manageteam if member did not change its own admin privileges
2365                 if ($member->isBlogAdmin($blogid))
2366                         $this->action_manageteam();
2367                 else
2368                         $this->action_overview(_MSG_ADMINCHANGED);
2369         }
2370
2371         /**
2372          * @todo document this
2373          */
2374         function action_blogsettings() {
2375                 global $member, $manager;
2376
2377                 $blogid = intRequestVar('blogid');
2378
2379                 // check if allowed
2380                 $member->blogAdminRights($blogid) or $this->disallow();
2381
2382                 $blog =& $manager->getBlog($blogid);
2383
2384                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2385                 $this->pagehead($extrahead);
2386
2387                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
2388                 ?>
2389                 <h2><?php echo _EBLOG_TITLE?>: '<?php echo $this->bloglink($blog)?>'</h2>
2390
2391                 <h3><?php echo _EBLOG_TEAM_TITLE?></h3>
2392
2393                 <p>Members currently on your team:
2394                 <?php
2395                         $res = sql_query('SELECT mname, mrealname FROM ' . sql_table('member') . ',' . sql_table('team') . ' WHERE mnumber=tmember AND tblog=' . intval($blogid));
2396                         $aMemberNames = array();
2397                         while ($o = mysql_fetch_object($res))
2398                                 array_push($aMemberNames, htmlspecialchars($o->mname) . ' (' . htmlspecialchars($o->mrealname). ')');
2399                         echo implode(',', $aMemberNames);
2400                 ?>
2401                 </p>
2402
2403
2404
2405                 <p>
2406                 <a href="index.php?action=manageteam&amp;blogid=<?php echo $blogid?>"><?php echo _EBLOG_TEAM_TEXT?></a>
2407                 </p>
2408
2409                 <h3><?php echo _EBLOG_SETTINGS_TITLE?></h3>
2410
2411                 <form method="post" action="index.php"><div>
2412
2413                 <input type="hidden" name="action" value="blogsettingsupdate" />
2414                 <?php $manager->addTicketHidden() ?>
2415                 <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2416                 <table><tr>
2417                         <td><?php echo _EBLOG_NAME?></td>
2418                         <td><input name="name" tabindex="10" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getName()) ?>" /></td>
2419                 </tr><tr>
2420                         <td><?php echo _EBLOG_SHORTNAME?> <?php help('shortblogname'); ?>
2421                                 <?php echo _EBLOG_SHORTNAME_EXTRA?>
2422                         </td>
2423                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" value="<?php echo  htmlspecialchars($blog->getShortName()) ?>" /></td>
2424                 </tr><tr>
2425                         <td><?php echo _EBLOG_DESC?></td>
2426                         <td><input name="desc" tabindex="30" maxlength="200" size="40" value="<?php echo  htmlspecialchars($blog->getDescription()) ?>" /></td>
2427                 </tr><tr>
2428                         <td><?php echo _EBLOG_URL?></td>
2429                         <td><input name="url" tabindex="40" size="40" maxlength="100" value="<?php echo  htmlspecialchars($blog->getURL()) ?>" /></td>
2430                 </tr><tr>
2431                         <td><?php echo _EBLOG_DEFSKIN?>
2432                                 <?php help('blogdefaultskin'); ?>
2433                         </td>
2434                         <td>
2435                                 <?php
2436                                         $query =  'SELECT sdname as text, sdnumber as value'
2437                                                    . ' FROM '.sql_table('skin_desc');
2438                                         $template['name'] = 'defskin';
2439                                         $template['selected'] = $blog->getDefaultSkin();
2440                                         $template['tabindex'] = 50;
2441                                         showlist($query,'select',$template);
2442                                 ?>
2443
2444                         </td>
2445                 </tr><tr>
2446                         <td><?php echo _EBLOG_LINEBREAKS?> <?php help('convertbreaks'); ?>
2447                         </td>
2448                         <td><?php $this->input_yesno('convertbreaks',$blog->convertBreaks(),55); ?></td>
2449                 </tr><tr>
2450                         <td><?php echo _EBLOG_ALLOWPASTPOSTING?> <?php help('allowpastposting'); ?>
2451                         </td>
2452                         <td><?php $this->input_yesno('allowpastposting',$blog->allowPastPosting(),57); ?></td>
2453                 </tr><tr>
2454                         <td><?php echo _EBLOG_DISABLECOMMENTS?>
2455                         </td>
2456                         <td><?php $this->input_yesno('comments',$blog->commentsEnabled(),60); ?></td>
2457                 </tr><tr>
2458                         <td><?php echo _EBLOG_ANONYMOUS?>
2459                         </td>
2460                         <td><?php $this->input_yesno('public',$blog->isPublic(),70); ?></td>
2461                 </tr><tr>
2462         <td><?php echo _EBLOG_REQUIREDEMAIL?>
2463                  </td>
2464                  <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
2465           </tr><tr>
2466                         <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
2467                         <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
2468                 </tr><tr>
2469                         <td><?php echo _EBLOG_NOTIFY_ON?></td>
2470                         <td>
2471                                 <input name="notifyComment" value="3" type="checkbox" tabindex="81" id="notifyComment"
2472                                         <?php if  ($blog->notifyOnComment()) echo "checked='checked'" ?>
2473                                 /><label for="notifyComment"><?php echo _EBLOG_NOTIFY_COMMENT?></label>
2474                                 <br />
2475                                 <input name="notifyVote" value="5" type="checkbox" tabindex="82" id="notifyVote"
2476                                         <?php if  ($blog->notifyOnVote()) echo "checked='checked'" ?>
2477                                 /><label for="notifyVote"><?php echo _EBLOG_NOTIFY_KARMA?></label>
2478                                 <br />
2479                                 <input name="notifyNewItem" value="7" type="checkbox" tabindex="83" id="notifyNewItem"
2480                                         <?php if  ($blog->notifyOnNewItem()) echo "checked='checked'" ?>
2481                                 /><label for="notifyNewItem"><?php echo _EBLOG_NOTIFY_ITEM?></label>
2482                         </td>
2483                 </tr><tr>
2484                         <td><?php echo _EBLOG_PING?> <?php help('pinguserland'); ?></td>
2485                         <td><?php $this->input_yesno('pinguserland',$blog->pingUserland(),85); ?></td>
2486                 </tr><tr>
2487                         <td><?php echo _EBLOG_MAXCOMMENTS?> <?php help('blogmaxcomments'); ?></td>
2488                         <td><input name="maxcomments" tabindex="90" size="3" value="<?php echo  htmlspecialchars($blog->getMaxComments()); ?>" /></td>
2489                 </tr><tr>
2490                         <td><?php echo _EBLOG_UPDATE?> <?php help('blogupdatefile'); ?></td>
2491                         <td><input name="update" tabindex="100" size="40" maxlength="60" value="<?php echo  htmlspecialchars($blog->getUpdateFile()) ?>" /></td>
2492                 </tr><tr>
2493                         <td><?php echo _EBLOG_DEFCAT?></td>
2494                         <td>
2495                                 <?php
2496                                         $query =  'SELECT cname as text, catid as value'
2497                                                    . ' FROM '.sql_table('category')
2498                                                    . ' WHERE cblog=' . $blog->getID();
2499                                         $template['name'] = 'defcat';
2500                                         $template['selected'] = $blog->getDefaultCategory();
2501                                         $template['tabindex'] = 110;
2502                                         showlist($query,'select',$template);
2503                                 ?>
2504                         </td>
2505                 </tr><tr>
2506                         <td><?php echo _EBLOG_OFFSET?> <?php help('blogtimeoffset'); ?>
2507                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
2508                                 <br /><?php echo _EBLOG_BTIME?> <b><?php echo  strftime("%H:%M",$blog->getCorrectTime()); ?></b>
2509                                 </td>
2510                         <td><input name="timeoffset" tabindex="120" size="3" value="<?php echo  htmlspecialchars($blog->getTimeOffset()); ?>" /></td>
2511                 </tr><tr>
2512                         <td><?php echo _EBLOG_SEARCH?> <?php help('blogsearchable'); ?></td>
2513                         <td><?php $this->input_yesno('searchable',$blog->getSearchable(),122); ?></td>
2514                 </tr>
2515                 <?php
2516                         // plugin options
2517                         $this->_insertPluginOptions('blog',$blogid);
2518                 ?>
2519                 <tr>
2520                         <th colspan="2"><?php echo _EBLOG_CHANGE?></th>
2521                 </tr><tr>
2522                         <td><?php echo _EBLOG_CHANGE?></td>
2523                         <td><input type="submit" tabindex="130" value="<?php echo _EBLOG_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
2524                 </tr></table>
2525
2526                 </div></form>
2527
2528                 <h3><?php echo _EBLOG_CAT_TITLE?></h3>
2529
2530
2531                 <?php
2532                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cblog='.$blog->getID().' ORDER BY cname';
2533                 $template['content'] = 'categorylist';
2534                 $template['tabindex'] = 200;
2535
2536                 $manager->loadClass("ENCAPSULATE");
2537                 $batch =& new BATCH('category');
2538                 $batch->showlist($query,'table',$template);
2539
2540                 ?>
2541
2542
2543                 <form action="index.php" method="post"><div>
2544                 <input name="action" value="categorynew" type="hidden" />
2545                 <?php $manager->addTicketHidden() ?>
2546                 <input name="blogid" value="<?php echo $blog->getID()?>" type="hidden" />
2547
2548                 <table><tr>
2549                         <th colspan="2"><?php echo _EBLOG_CAT_CREATE?></th>
2550                 </tr><tr>
2551                         <td><?php echo _EBLOG_CAT_NAME?></td>
2552                         <td><input name="cname" size="40" maxlength="40" tabindex="300" /></td>
2553                 </tr><tr>
2554                         <td><?php echo _EBLOG_CAT_DESC?></td>
2555                         <td><input name="cdesc" size="40" maxlength="200" tabindex="310" /></td>
2556                 </tr><tr>
2557                         <td><?php echo _EBLOG_CAT_CREATE?></td>
2558                         <td><input type="submit" value="<?php echo _EBLOG_CAT_CREATE?>" tabindex="320" /></td>
2559                 </tr></table>
2560
2561                 </div></form>
2562
2563                 <?php
2564
2565                         echo '<h3>',_PLUGINS_EXTRA,'</h3>';
2566
2567                         $manager->notify(
2568                                 'BlogSettingsFormExtras',
2569                                 array(
2570                                         'blog' => &$blog
2571                                 )
2572                         );
2573
2574                 $this->pagefoot();
2575         }
2576
2577         /**
2578          * @todo document this
2579          */
2580         function action_categorynew() {
2581                 global $member, $manager;
2582
2583                 $blogid = intRequestVar('blogid');
2584
2585                 $member->blogAdminRights($blogid) or $this->disallow();
2586
2587                 $cname = postVar('cname');
2588                 $cdesc = postVar('cdesc');
2589
2590                 if (!isValidCategoryName($cname))
2591                         $this->error(_ERROR_BADCATEGORYNAME);
2592
2593                 $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
2594                 $res = sql_query($query);
2595                 if (mysql_num_rows($res) > 0)
2596                         $this->error(_ERROR_DUPCATEGORYNAME);
2597
2598                 $blog           =& $manager->getBlog($blogid);
2599                 $newCatID       =  $blog->createNewCategory($cname, $cdesc);
2600
2601                 $this->action_blogsettings();
2602         }
2603
2604         /**
2605          * @todo document this
2606          */
2607         function action_categoryedit($catid = '', $blogid = '', $desturl = '') {
2608                 global $member, $manager;
2609
2610                 if ($blogid == '')
2611                         $blogid = intGetVar('blogid');
2612                 else
2613                         $blogid = intval($blogid);
2614                 if ($catid == '')
2615                         $catid = intGetVar('catid');
2616                 else
2617                         $catid = intval($catid);
2618
2619                 $member->blogAdminRights($blogid) or $this->disallow();
2620
2621                 $res = sql_query('SELECT * FROM '.sql_table('category')." WHERE cblog=$blogid AND catid=$catid");
2622                 $obj = mysql_fetch_object($res);
2623
2624                 $cname = $obj->cname;
2625                 $cdesc = $obj->cdesc;
2626
2627                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
2628                 $this->pagehead($extrahead);
2629
2630                 echo "<p><a href='index.php?action=blogsettings&amp;blogid=$blogid'>(",_BACK_TO_BLOGSETTINGS,")</a></p>";
2631
2632                 ?>
2633                 <h2><?php echo _EBLOG_CAT_UPDATE?> '<?php echo htmlspecialchars($cname)?>'</h2>
2634                 <form method='post' action='index.php'><div>
2635                 <input name="blogid" type="hidden" value="<?php echo $blogid?>" />
2636                 <input name="catid" type="hidden" value="<?php echo $catid?>" />
2637                 <input name="desturl" type="hidden" value="<?php echo htmlspecialchars($desturl) ?>" />
2638                 <input name="action" type="hidden" value="categoryupdate" />
2639                 <?php $manager->addTicketHidden(); ?>
2640
2641                 <table><tr>
2642                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2643                 </tr><tr>
2644                         <td><?php echo _EBLOG_CAT_NAME?></td>
2645                         <td><input type="text" name="cname" value="<?php echo htmlspecialchars($cname)?>" size="40" maxlength="40" /></td>
2646                 </tr><tr>
2647                         <td><?php echo _EBLOG_CAT_DESC?></td>
2648                         <td><input type="text" name="cdesc" value="<?php echo htmlspecialchars($cdesc)?>" size="40" maxlength="200" /></td>
2649                 </tr>
2650                 <?php
2651                         // insert plugin options
2652                         $this->_insertPluginOptions('category',$catid);
2653                 ?>
2654                 <tr>
2655                         <th colspan="2"><?php echo _EBLOG_CAT_UPDATE ?></th>
2656                 </tr><tr>
2657                         <td><?php echo _EBLOG_CAT_UPDATE?></td>
2658                         <td><input type="submit" value="<?php echo _EBLOG_CAT_UPDATE_BTN?>" /></td>
2659                 </tr></table>
2660
2661                 </div></form>
2662                 <?php
2663                 $this->pagefoot();
2664         }
2665
2666         /**
2667          * @todo document this
2668          */
2669         function action_categoryupdate() {
2670                 global $member, $manager;
2671
2672                 $blogid = intPostVar('blogid');
2673                 $catid = intPostVar('catid');
2674                 $cname = postVar('cname');
2675                 $cdesc = postVar('cdesc');
2676                 $desturl = postVar('desturl');
2677
2678                 $member->blogAdminRights($blogid) or $this->disallow();
2679
2680                 if (!isValidCategoryName($cname))
2681                         $this->error(_ERROR_BADCATEGORYNAME);
2682
2683                 $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
2684                 $res = sql_query($query);
2685                 if (mysql_num_rows($res) > 0)
2686                         $this->error(_ERROR_DUPCATEGORYNAME);
2687
2688                 $query =  'UPDATE '.sql_table('category').' SET'
2689                            . " cname='" . addslashes($cname) . "',"
2690                            . " cdesc='" . addslashes($cdesc) . "'"
2691                            . " WHERE catid=" . $catid;
2692
2693                 sql_query($query);
2694
2695                 // store plugin options
2696                 $aOptions = requestArray('plugoption');
2697                 NucleusPlugin::_applyPluginOptions($aOptions);
2698                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'category', 'catid' => $catid));
2699
2700
2701                 if ($desturl) {
2702                         redirect($desturl);
2703                         exit;
2704                 } else {
2705                         $this->action_blogsettings();
2706                 }
2707         }
2708
2709         /**
2710          * @todo document this
2711          */
2712         function action_categorydelete() {
2713                 global $member, $manager;
2714
2715                 $blogid = intRequestVar('blogid');
2716                 $catid = intRequestVar('catid');
2717
2718                 $member->blogAdminRights($blogid) or $this->disallow();
2719
2720                 $blog =& $manager->getBlog($blogid);
2721
2722                 // check if the category is valid
2723                 if (!$blog->isValidCategory($catid))
2724                         $this->error(_ERROR_NOSUCHCATEGORY);
2725
2726                 // don't allow deletion of default category
2727                 if ($blog->getDefaultCategory() == $catid)
2728                         $this->error(_ERROR_DELETEDEFCATEGORY);
2729
2730                 // check if catid is the only category left for blogid
2731                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2732                 $res = sql_query($query);
2733                 if (mysql_num_rows($res) == 1)
2734                         $this->error(_ERROR_DELETELASTCATEGORY);
2735
2736
2737                 $this->pagehead();
2738                 ?>
2739                         <h2><?php echo _DELETE_CONFIRM?></h2>
2740
2741                         <div>
2742                         <?php echo _CONFIRMTXT_CATEGORY?><b><?php echo  $blog->getCategoryName($catid)?></b>
2743                         </div>
2744
2745                         <form method="post" action="index.php"><div>
2746                         <input type="hidden" name="action" value="categorydeleteconfirm" />
2747                         <?php $manager->addTicketHidden() ?>
2748                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
2749                         <input type="hidden" name="catid" value="<?php echo $catid?>" />
2750                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2751                         </div></form>
2752                 <?php
2753                 $this->pagefoot();
2754         }
2755
2756         /**
2757          * @todo document this
2758          */
2759         function action_categorydeleteconfirm() {
2760                 global $member, $manager;
2761
2762                 $blogid = intRequestVar('blogid');
2763                 $catid = intRequestVar('catid');
2764
2765                 $member->blogAdminRights($blogid) or $this->disallow();
2766
2767                 $error = $this->deleteOneCategory($catid);
2768                 if ($error)
2769                         $this->error($error);
2770
2771                 $this->action_blogsettings();
2772         }
2773
2774         /**
2775          * @todo document this
2776          */
2777         function deleteOneCategory($catid) {
2778                 global $manager, $member;
2779
2780                 $catid = intval($catid);
2781
2782                 $manager->notify('PreDeleteCategory', array('catid' => $catid));
2783
2784                 $blogid = getBlogIDFromCatID($catid);
2785
2786                 if (!$member->blogAdminRights($blogid))
2787                         return ERROR_DISALLOWED;
2788
2789                 // get blog
2790                 $blog =& $manager->getBlog($blogid);
2791
2792                 // check if the category is valid
2793                 if (!$blog || !$blog->isValidCategory($catid))
2794                         return _ERROR_NOSUCHCATEGORY;
2795
2796                 $destcatid = $blog->getDefaultCategory();
2797
2798                 // don't allow deletion of default category
2799                 if ($blog->getDefaultCategory() == $catid)
2800                         return _ERROR_DELETEDEFCATEGORY;
2801
2802                 // check if catid is the only category left for blogid
2803                 $query = 'SELECT catid FROM '.sql_table('category').' WHERE cblog=' . $blogid;
2804                 $res = sql_query($query);
2805                 if (mysql_num_rows($res) == 1)
2806                         return _ERROR_DELETELASTCATEGORY;
2807
2808                 // change category for all items to the default category
2809                 $query = 'UPDATE '.sql_table('item')." SET icat=$destcatid WHERE icat=$catid";
2810                 sql_query($query);
2811
2812                 // delete all associated plugin options
2813                 NucleusPlugin::_deleteOptionValues('category', $catid);
2814
2815                 // delete category
2816                 $query = 'DELETE FROM '.sql_table('category').' WHERE catid=' .$catid;
2817                 sql_query($query);
2818
2819                 $manager->notify('PostDeleteCategory', array('catid' => $catid));
2820
2821         }
2822
2823         /**
2824          * @todo document this
2825          */
2826         function moveOneCategory($catid, $destblogid) {
2827                 global $manager, $member;
2828
2829                 $catid = intval($catid);
2830                 $destblogid = intval($destblogid);
2831
2832                 $blogid = getBlogIDFromCatID($catid);
2833
2834                 // mover should have admin rights on both blogs
2835                 if (!$member->blogAdminRights($blogid))
2836                         return _ERROR_DISALLOWED;
2837                 if (!$member->blogAdminRights($destblogid))
2838                         return _ERROR_DISALLOWED;
2839
2840                 // cannot move to self
2841                 if ($blogid == $destblogid)
2842                         return _ERROR_MOVETOSELF;
2843
2844                 // get blogs
2845                 $blog =& $manager->getBlog($blogid);
2846                 $destblog =& $manager->getBlog($destblogid);
2847
2848                 // check if the category is valid
2849                 if (!$blog || !$blog->isValidCategory($catid))
2850                         return _ERROR_NOSUCHCATEGORY;
2851
2852                 // don't allow default category to be moved
2853                 if ($blog->getDefaultCategory() == $catid)
2854                         return _ERROR_MOVEDEFCATEGORY;
2855
2856                 $manager->notify(
2857                         'PreMoveCategory',
2858                         array(
2859                                 'catid' => &$catid,
2860                                 'sourceblog' => &$blog,
2861                                 'destblog' => &$destblog
2862                         )
2863                 );
2864
2865                 // update comments table (cblog)
2866                 $query = 'SELECT inumber FROM '.sql_table('item').' WHERE icat='.$catid;
2867                 $items = sql_query($query);
2868                 while ($oItem = mysql_fetch_object($items)) {
2869                         sql_query('UPDATE '.sql_table('comment').' SET cblog='.$destblogid.' WHERE citem='.$oItem->inumber);
2870                 }
2871
2872                 // update items (iblog)
2873                 $query = 'UPDATE '.sql_table('item').' SET iblog='.$destblogid.' WHERE icat='.$catid;
2874                 sql_query($query);
2875
2876                 // move category
2877                 $query = 'UPDATE '.sql_table('category').' SET cblog='.$destblogid.' WHERE catid='.$catid;
2878                 sql_query($query);
2879
2880                 $manager->notify(
2881                         'PostMoveCategory',
2882                         array(
2883                                 'catid' => &$catid,
2884                                 'sourceblog' => &$blog,
2885                                 'destblog' => $destblog
2886                         )
2887                 );
2888
2889         }
2890
2891         /**
2892          * @todo document this
2893          */
2894         function action_blogsettingsupdate() {
2895                 global $member, $manager;
2896
2897                 $blogid = intRequestVar('blogid');
2898
2899                 $member->blogAdminRights($blogid) or $this->disallow();
2900
2901                 $blog =& $manager->getBlog($blogid);
2902
2903                 $notify                 = trim(postVar('notify'));
2904                 $shortname              = trim(postVar('shortname'));
2905                 $updatefile             = trim(postVar('update'));
2906
2907                 $notifyComment  = intPostVar('notifyComment');
2908                 $notifyVote             = intPostVar('notifyVote');
2909                 $notifyNewItem  = intPostVar('notifyNewItem');
2910
2911                 if ($notifyComment == 0)        $notifyComment = 1;
2912                 if ($notifyVote == 0)           $notifyVote = 1;
2913                 if ($notifyNewItem == 0)        $notifyNewItem = 1;
2914
2915                 $notifyType = $notifyComment * $notifyVote * $notifyNewItem;
2916
2917
2918                 if ($notify) {
2919                         $not =& new NOTIFICATION($notify);
2920                         if (!$not->validAddresses())
2921                                 $this->error(_ERROR_BADNOTIFY);
2922
2923                 }
2924
2925                 if (!isValidShortName($shortname))
2926                         $this->error(_ERROR_BADSHORTBLOGNAME);
2927
2928                 if (($blog->getShortName() != $shortname) && $manager->existsBlog($shortname))
2929                         $this->error(_ERROR_DUPSHORTBLOGNAME);
2930
2931                 // check if update file is writable
2932                 if ($updatefile && !is_writeable($updatefile))
2933                         $this->error(_ERROR_UPDATEFILE);
2934
2935                 $blog->setName(trim(postVar('name')));
2936                 $blog->setShortName($shortname);
2937                 $blog->setNotifyAddress($notify);
2938                 $blog->setNotifyType($notifyType);
2939                 $blog->setMaxComments(postVar('maxcomments'));
2940                 $blog->setCommentsEnabled(postVar('comments'));
2941                 $blog->setTimeOffset(postVar('timeoffset'));
2942                 $blog->setUpdateFile($updatefile);
2943                 $blog->setURL(trim(postVar('url')));
2944                 $blog->setDefaultSkin(intPostVar('defskin'));
2945                 $blog->setDescription(trim(postVar('desc')));
2946                 $blog->setPublic(postVar('public'));
2947                 $blog->setPingUserland(postVar('pinguserland'));
2948                 $blog->setConvertBreaks(intPostVar('convertbreaks'));
2949                 $blog->setAllowPastPosting(intPostVar('allowpastposting'));
2950                 $blog->setDefaultCategory(intPostVar('defcat'));
2951                 $blog->setSearchable(intPostVar('searchable'));
2952                 $blog->setEmailRequired(intPostVar('reqemail'));
2953
2954                 $blog->writeSettings();
2955
2956                 // store plugin options
2957                 $aOptions = requestArray('plugoption');
2958                 NucleusPlugin::_applyPluginOptions($aOptions);
2959                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'blog', 'blogid' => $blogid, 'blog' => &$blog));
2960
2961
2962                 $this->action_overview(_MSG_SETTINGSCHANGED);
2963         }
2964
2965         /**
2966          * @todo document this
2967          */
2968         function action_deleteblog() {
2969                 global $member, $CONF, $manager;
2970
2971                 $blogid = intRequestVar('blogid');
2972
2973                 $member->blogAdminRights($blogid) or $this->disallow();
2974
2975                 // check if blog is default blog
2976                 if ($CONF['DefaultBlog'] == $blogid)
2977                         $this->error(_ERROR_DELDEFBLOG);
2978
2979                 $blog =& $manager->getBlog($blogid);
2980
2981                 $this->pagehead();
2982                 ?>
2983                         <h2><?php echo _DELETE_CONFIRM?></h2>
2984
2985                         <p><?php echo _WARNINGTXT_BLOGDEL?>
2986                         </p>
2987
2988                         <div>
2989                         <?php echo _CONFIRMTXT_BLOG?><b><?php echo  htmlspecialchars($blog->getName())?></b>
2990                         </div>
2991
2992                         <form method="post" action="index.php"><div>
2993                         <input type="hidden" name="action" value="deleteblogconfirm" />
2994                         <?php $manager->addTicketHidden() ?>
2995                         <input type="hidden" name="blogid" value="<?php echo  $blogid; ?>" />
2996                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
2997                         </div></form>
2998                 <?php
2999                 $this->pagefoot();
3000         }
3001
3002         /**
3003          * @todo document this
3004          */
3005         function action_deleteblogconfirm() {
3006                 global $member, $CONF, $manager;
3007
3008                 $blogid = intRequestVar('blogid');
3009
3010                 $manager->notify('PreDeleteBlog', array('blogid' => $blogid));
3011
3012                 $member->blogAdminRights($blogid) or $this->disallow();
3013
3014                 // check if blog is default blog
3015                 if ($CONF['DefaultBlog'] == $blogid)
3016                         $this->error(_ERROR_DELDEFBLOG);
3017
3018                 // delete all comments
3019                 $query = 'DELETE FROM '.sql_table('comment').' WHERE cblog='.$blogid;
3020                 sql_query($query);
3021
3022                 // delete all items
3023                 $query = 'DELETE FROM '.sql_table('item').' WHERE iblog='.$blogid;
3024                 sql_query($query);
3025
3026                 // delete all team members
3027                 $query = 'DELETE FROM '.sql_table('team').' WHERE tblog='.$blogid;
3028                 sql_query($query);
3029
3030                 // delete all bans
3031                 $query = 'DELETE FROM '.sql_table('ban').' WHERE blogid='.$blogid;
3032                 sql_query($query);
3033
3034                 // delete all categories
3035                 $query = 'DELETE FROM '.sql_table('category').' WHERE cblog='.$blogid;
3036                 sql_query($query);
3037
3038                 // delete all associated plugin options
3039                 NucleusPlugin::_deleteOptionValues('blog', $blogid);
3040
3041                 // delete the blog itself
3042                 $query = 'DELETE FROM '.sql_table('blog').' WHERE bnumber='.$blogid;
3043                 sql_query($query);
3044
3045                 $manager->notify('PostDeleteBlog', array('blogid' => $blogid));
3046
3047                 $this->action_overview(_DELETED_BLOG);
3048         }
3049
3050         /**
3051          * @todo document this
3052          */
3053         function action_memberdelete() {
3054                 global $member, $manager;
3055
3056                 $memberid = intRequestVar('memberid');
3057
3058                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3059
3060                 $mem = MEMBER::createFromID($memberid);
3061
3062                 $this->pagehead();
3063                 ?>
3064                         <h2><?php echo _DELETE_CONFIRM?></h2>
3065
3066                         <p><?php echo _CONFIRMTXT_MEMBER?><b><?php echo  $mem->getDisplayName() ?></b>
3067                         </p>
3068
3069                         <p>
3070                         Please note that media files will <b>NOT</b> be deleted. (At least not in this Nucleus version)
3071                         </p>
3072
3073                         <form method="post" action="index.php"><div>
3074                         <input type="hidden" name="action" value="memberdeleteconfirm" />
3075                         <?php $manager->addTicketHidden() ?>
3076                         <input type="hidden" name="memberid" value="<?php echo  $memberid; ?>" />
3077                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3078                         </div></form>
3079                 <?php
3080                 $this->pagefoot();
3081         }
3082
3083         /**
3084          * @todo document this
3085          */
3086         function action_memberdeleteconfirm() {
3087                 global $member;
3088
3089                 $memberid = intRequestVar('memberid');
3090
3091                 ($member->getID() == $memberid) or $member->isAdmin() or $this->disallow();
3092
3093                 $error = $this->deleteOneMember($memberid);
3094                 if ($error)
3095                         $this->error($error);
3096
3097                 if ($member->isAdmin())
3098                         $this->action_usermanagement();
3099                 else
3100                         $this->action_overview(_DELETED_MEMBER);
3101         }
3102
3103         /**
3104          * @static
3105          * @todo document this
3106          */
3107         function deleteOneMember($memberid) {
3108                 global $manager;
3109
3110                 $memberid = intval($memberid);
3111                 $mem = MEMBER::createFromID($memberid);
3112
3113                 if (!$mem->canBeDeleted())
3114                         return _ERROR_DELETEMEMBER;
3115
3116                 $manager->notify('PreDeleteMember', array('member' => &$mem));
3117
3118                 /* unlink comments from memberid */
3119                 $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
3120                                         .'" WHERE cmember='.$memberid;
3121                 sql_query($query);
3122
3123                 $query = 'DELETE FROM '.sql_table('member').' WHERE mnumber='.$memberid;
3124                 sql_query($query);
3125
3126                 $query = 'DELETE FROM '.sql_table('team').' WHERE tmember='.$memberid;
3127                 sql_query($query);
3128
3129                 $query = 'DELETE FROM '.sql_table('activation').' WHERE vmember='.$memberid;
3130                 sql_query($query);
3131
3132                 // delete all associated plugin options
3133                 NucleusPlugin::_deleteOptionValues('member', $memberid);
3134
3135                 $manager->notify('PostDeleteMember', array('member' => &$mem));
3136
3137                 return '';
3138         }
3139
3140         /**
3141          * @todo document this
3142          */
3143         function action_createnewlog() {
3144                 global $member, $CONF, $manager;
3145
3146                 // Only Super-Admins can do this
3147                 $member->isAdmin() or $this->disallow();
3148
3149                 $this->pagehead();
3150
3151                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3152                 ?>
3153                 <h2><?php echo _EBLOG_CREATE_TITLE?></h2>
3154
3155                 <h3>注意事項</h3>
3156
3157                 <p>作成にあたって、下記の<strong>注意事項</strong> をまずお読み下さい</p>
3158
3159                 <p>新しいweblogを作成した後に、このblogにアクセスするための方法を紹介しておきます。方法は2つあります:</p>
3160
3161                 <ol>
3162                         <li><strong>簡単な方法:</strong> <code>index.php</code>の複製を作り、新しいblogを表示するように変更を加えます。 この変更の詳細は、作成後に表示されます。</li>
3163                         <li><strong>高度な方法:</strong> 現在のblogで使用しているスキンに<code>otherblog</code>というコードを使った記述を加えます。この方法では、同じページ内で複数のblogを展開することが可能となります。</li>
3164                 </ol>
3165
3166                 <h3>Weblogの作成</h3>
3167
3168                 <p>
3169                 <?php echo _EBLOG_CREATE_TEXT?>
3170                 </p>
3171
3172                 <form method="post" action="index.php"><div>
3173
3174                 <input type="hidden" name="action" value="addnewlog" />
3175                 <?php $manager->addTicketHidden() ?>
3176
3177
3178                 <table><tr>
3179                         <td><?php echo _EBLOG_NAME?></td>
3180                         <td><input name="name" tabindex="10" size="40" maxlength="60" /></td>
3181                 </tr><tr>
3182                         <td><?php echo _EBLOG_SHORTNAME?>
3183                                 <?php help('shortblogname'); ?>
3184                         </td>
3185                         <td><input name="shortname" tabindex="20" maxlength="15" size="15" /></td>
3186                 </tr><tr>
3187                         <td><?php echo _EBLOG_DESC?></td>
3188                         <td><input name="desc" tabindex="30" maxlength="200" size="40" /></td>
3189                 </tr><tr>
3190                         <td><?php echo _EBLOG_DEFSKIN?>
3191                                 <?php help('blogdefaultskin'); ?>
3192                         </td>
3193                         <td>
3194                                 <?php
3195                                         $query =  'SELECT sdname as text, sdnumber as value'
3196                                                    . ' FROM '.sql_table('skin_desc');
3197                                         $template['name'] = 'defskin';
3198                                         $template['tabindex'] = 50;
3199                                         $template['selected'] = $CONF['BaseSkin'];      // set default selected skin to be globally defined base skin
3200                                         showlist($query,'select',$template);
3201                                 ?>
3202                         </td>
3203                 </tr><tr>
3204                         <td><?php echo _EBLOG_OFFSET?>
3205                                 <?php help('blogtimeoffset'); ?>
3206                                 <br /><?php echo _EBLOG_STIME?> <b><?php echo  strftime("%H:%M",time()); ?></b>
3207                         </td>
3208                         <td><input name="timeoffset" tabindex="110" size="3" value="0" /></td>
3209                 </tr><tr>
3210                         <td><?php echo _EBLOG_ADMIN?>
3211                                 <?php help('blogadmin'); ?>
3212                         </td>
3213                         <td><?php echo _EBLOG_ADMIN_MSG?></td>
3214                 </tr><tr>
3215                         <td><?php echo _EBLOG_CREATE?></td>
3216                         <td><input type="submit" tabindex="120" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3217                 </tr></table>
3218
3219                 </div></form>
3220                 <?php
3221                 $this->pagefoot();
3222         }
3223
3224         /**
3225          * @todo document this
3226          */
3227         function action_addnewlog() {
3228                 global $member, $manager, $CONF;
3229
3230                 // Only Super-Admins can do this
3231                 $member->isAdmin() or $this->disallow();
3232
3233                 $bname                  = trim(postVar('name'));
3234                 $bshortname             = trim(postVar('shortname'));
3235                 $btimeoffset    = postVar('timeoffset');
3236                 $bdesc                  = trim(postVar('desc'));
3237                 $bdefskin               = postVar('defskin');
3238
3239                 if (!isValidShortName($bshortname))
3240                         $this->error(_ERROR_BADSHORTBLOGNAME);
3241
3242                 if ($manager->existsBlog($bshortname))
3243                         $this->error(_ERROR_DUPSHORTBLOGNAME);
3244
3245                 $manager->notify(
3246                         'PreAddBlog',
3247                         array(
3248                                 'name' => &$bname,
3249                                 'shortname' => &$bshortname,
3250                                 'timeoffset' => &$btimeoffset,
3251                                 'description' => &$bdescription,
3252                                 'defaultskin' => &$bdefskin
3253                         )
3254                 );
3255
3256
3257                 // add slashes for sql queries
3258                 $bname =                addslashes($bname);
3259                 $bshortname =   addslashes($bshortname);
3260                 $btimeoffset =  addslashes($btimeoffset);
3261                 $bdesc =                addslashes($bdesc);
3262                 $bdefskin =     addslashes($bdefskin);
3263
3264                 // create blog
3265                 $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
3266                 sql_query($query);
3267                 $blogid = mysql_insert_id();
3268                 $blog   =& $manager->getBlog($blogid);
3269
3270                 // create new category
3271                 sql_query('INSERT INTO '.sql_table('category')." (cblog, cname, cdesc) VALUES ($blogid, 'General','Items that do not fit in other categories')");
3272                 $catid = mysql_insert_id();
3273
3274                 // set as default category
3275                 $blog->setDefaultCategory($catid);
3276                 $blog->writeSettings();
3277
3278                 // create team member
3279                 $memberid = $member->getID();
3280                 $query = 'INSERT INTO '.sql_table('team')." (tmember, tblog, tadmin) VALUES ($memberid, $blogid, 1)";
3281                 sql_query($query);
3282
3283
3284                 $blog->additem($blog->getDefaultCategory(),'First Item','これはあなたのweblogにおける最初のアイテムです。自由に削除していただいてかまいません。','',$blogid, $memberid,$blog->getCorrectTime(),0,0,0);
3285
3286                 $manager->notify(
3287                         'PostAddBlog',
3288                         array(
3289                                 'blog' => &$blog
3290                         )
3291                 );
3292
3293                 $manager->notify(
3294                         'PostAddCategory',
3295                         array(
3296                                 'catid' => $catid
3297                         )
3298                 );
3299
3300                 $this->pagehead();
3301                 ?>
3302                 <h2>新しいweblogが作成されました</h2>
3303
3304                 <p>新しいweblog 「<?php echo htmlspecialchars($bname)?>」が作成されました。続けて、これにアクセスするために以下のどちらかの手順に進んでください。</p>
3305
3306                 <ol>
3307                         <li><a href="#index_php">簡単な方法: 下のコードを貼付けた <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成する</a></li>
3308                         <li><a href="#skins">高度な方法: 現在使用しているスキンに新しいweblogを展開させるための記述を加える</a></li>
3309                 </ol>
3310
3311                 <h3><a id="index_php">方法 1: <code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成</a></h3>
3312
3313                 <p><code><?php echo htmlspecialchars($bshortname)?>.php</code> というファイルを作成して、中身に以下のコードを貼り付ける:</p>
3314 <pre><code>&lt;?php
3315
3316 $CONF['Self'] = '<b><?php echo htmlspecialchars($bshortname)?>.php</b>';
3317
3318 include('<i>./config.php</i>');
3319
3320 selectBlog('<b><?php echo htmlspecialchars($bshortname)?></b>');
3321 selector();
3322
3323 ?&gt;</code></pre>
3324
3325                 <p>すでにある<code>index.php</code>と同じディレクトリにアップロードします。</p>
3326
3327                 <p>新しいweblogの作成を完了するためには、下にこのファイルのURLを入力してください。 (すでに用意した値で合っているとは思いますが保証はしません):</p>
3328
3329                 <form action="index.php" method="post"><div>
3330                         <input type="hidden" name="action" value="addnewlog2" />
3331                         <?php $manager->addTicketHidden() ?>
3332                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3333                         <table><tr>
3334                                 <td><?php echo _EBLOG_URL?></td>
3335                                 <td><input name="url" maxlength="100" size="40" value="<?php echo htmlspecialchars($CONF['IndexURL'].$bshortname.'.php')?>" /></td>
3336                         </tr><tr>
3337                                 <td><?php echo _EBLOG_CREATE?></td>
3338                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3339                         </tr></table>
3340                 </div></form>
3341
3342                 <h3><a id="skins">方法 2: 現在使用しているスキンに新しいweblogを展開する記述を加える</a></h3>
3343
3344                 <p>新しいweblogの作成を完了するためには、下にURLを入力してください。 (大抵は既存blogと同じURL)</p>
3345
3346                 <form action="index.php" method="post"><div>
3347                         <input type="hidden" name="action" value="addnewlog2" />
3348                         <?php $manager->addTicketHidden() ?>
3349                         <input type="hidden" name="blogid" value="<?php echo intval($blogid)?>" />
3350                         <table><tr>
3351                                 <td><?php echo _EBLOG_URL?></td>
3352                                 <td><input name="url" maxlength="100" size="40" /></td>
3353                         </tr><tr>
3354                                 <td><?php echo _EBLOG_CREATE?></td>
3355                                 <td><input type="submit" value="<?php echo _EBLOG_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3356                         </tr></table>
3357                 </div></form>
3358
3359                 <?php           $this->pagefoot();
3360
3361         }
3362
3363         /**
3364          * @todo document this
3365          */
3366         function action_addnewlog2() {
3367                 global $member, $manager;
3368
3369                 $member->blogAdminRights($blogid) or $this->disallow();
3370
3371                 $burl   = requestVar('url');
3372                 $blogid = intRequestVar('blogid');
3373
3374                 $blog =& $manager->getBlog($blogid);
3375                 $blog->setURL(trim($burl));
3376                 $blog->writeSettings();
3377
3378                 $this->action_overview(_MSG_NEWBLOG);
3379         }
3380
3381         /**
3382          * @todo document this
3383          */
3384         function action_skinieoverview() {
3385                 global $member, $DIR_LIBS, $manager;
3386
3387                 $member->isAdmin() or $this->disallow();
3388
3389                 // load skinie class
3390                 include_once($DIR_LIBS . 'skinie.php');
3391
3392                 $this->pagehead();
3393
3394                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3395
3396         ?>
3397                 <h2><?php echo _SKINIE_TITLE_IMPORT?></h2>
3398
3399                                 <p><label for="skinie_import_local"><?php echo _SKINIE_LOCAL?></label>
3400                                 <?php                                   global $DIR_SKINS;
3401
3402                                         $candidates = SKINIMPORT::searchForCandidates($DIR_SKINS);
3403
3404                                         if (sizeof($candidates) > 0) {
3405                                                 ?>
3406                                                         <form method="post" action="index.php"><div>
3407                                                                 <input type="hidden" name="action" value="skinieimport" />
3408                                                                 <?php $manager->addTicketHidden() ?>
3409                                                                 <input type="hidden" name="mode" value="file" />
3410                                                                 <select name="skinfile" id="skinie_import_local">
3411                                                                 <?php                                                                   foreach ($candidates as $skinname => $skinfile) {
3412                                                                                 $html = htmlspecialchars($skinfile);
3413                                                                                 echo '<option value="',$html,'">',$skinname,'</option>';
3414                                                                         }
3415                                                                 ?>
3416                                                                 </select>
3417                                                                 <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3418                                                         </div></form>
3419                                                 <?php                                   } else {
3420                                                 echo _SKINIE_NOCANDIDATES;
3421                                         }
3422                                 ?>
3423                                 </p>
3424
3425                                 <p><em><?php echo _OR?></em></p>
3426
3427                                 <form method="post" action="index.php"><p>
3428                                         <?php $manager->addTicketHidden() ?>
3429                                         <input type="hidden" name="action" value="skinieimport" />
3430                                         <input type="hidden" name="mode" value="url" />
3431                                         <label for="skinie_import_url"><?php echo _SKINIE_FROMURL?></label>
3432                                         <input type="text" name="skinfile" id="skinie_import_url" size="60" value="http://" />
3433                                         <input type="submit" value="<?php echo _SKINIE_BTN_IMPORT?>" />
3434                                 </p></form>
3435
3436
3437                 <h2><?php echo _SKINIE_TITLE_EXPORT?></h2>
3438                 <form method="post" action="index.php"><div>
3439                         <input type="hidden" name="action" value="skinieexport" />
3440                         <?php $manager->addTicketHidden() ?>
3441
3442                         <p><?php echo _SKINIE_EXPORT_INTRO?></p>
3443
3444                         <table><tr>
3445                                 <th colspan="2"><?php echo _SKINIE_EXPORT_SKINS?></th>
3446                         </tr><tr>
3447         <?php           // show list of skins
3448                 $res = sql_query('SELECT * FROM '.sql_table('skin_desc'));
3449                 while ($skinObj = mysql_fetch_object($res)) {
3450                         $id = 'skinexp' . $skinObj->sdnumber;
3451                         echo '<td><input type="checkbox" name="skin[',$skinObj->sdnumber,']"  id="',$id,'" />';
3452                         echo '<label for="',$id,'">',htmlspecialchars($skinObj->sdname),'</label></td>';
3453                         echo '<td>',htmlspecialchars($skinObj->sddesc),'</td>';
3454                         echo '</tr><tr>';
3455                 }
3456
3457                 echo '<th colspan="2">',_SKINIE_EXPORT_TEMPLATES,'</th></tr><tr>';
3458
3459                 // show list of templates
3460                 $res = sql_query('SELECT * FROM '.sql_table('template_desc'));
3461                 while ($templateObj = mysql_fetch_object($res)) {
3462                         $id = 'templateexp' . $templateObj->tdnumber;
3463                         echo '<td><input type="checkbox" name="template[',$templateObj->tdnumber,']" id="',$id,'" />';
3464                         echo '<label for="',$id,'">',htmlspecialchars($templateObj->tdname),'</label></td>';
3465                         echo '<td>',htmlspecialchars($templateObj->tddesc),'</td>';
3466                         echo '</tr><tr>';
3467                 }
3468
3469         ?>
3470                                 <th colspan="2"><?php echo _SKINIE_EXPORT_EXTRA?></th>
3471                         </tr><tr>
3472                                 <td colspan="2"><textarea cols="40" rows="5" name="info"></textarea></td>
3473                         </tr><tr>
3474                                 <th colspan="2"><?php echo _SKINIE_TITLE_EXPORT?></th>
3475                         </tr><tr>
3476                                 <td colspan="2"><input type="submit" value="<?php echo _SKINIE_BTN_EXPORT?>" /></td>
3477                         </tr></table>
3478                 </div></form>
3479
3480         <?php
3481                 $this->pagefoot();
3482
3483         }
3484
3485         /**
3486          * @todo document this
3487          */
3488         function action_skinieimport() {
3489                 global $member, $DIR_LIBS, $DIR_SKINS, $manager;
3490
3491                 $member->isAdmin() or $this->disallow();
3492
3493                 // load skinie class
3494                 include_once($DIR_LIBS . 'skinie.php');
3495
3496                 $skinFileRaw= postVar('skinfile');
3497                 $mode           = postVar('mode');
3498
3499                 $importer =& new SKINIMPORT();
3500
3501                 // get full filename
3502                 if ($mode == 'file')
3503                 {
3504                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3505
3506                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3507                         if (!file_exists($skinFile))
3508                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3509                 } else {
3510                         $skinFile = $skinFileRaw;
3511                 }
3512
3513                 // read only metadata
3514                 $error = $importer->readFile($skinFile, 1);
3515
3516                 // clashes
3517                 $skinNameClashes = $importer->checkSkinNameClashes();
3518                 $templateNameClashes = $importer->checkTemplateNameClashes();
3519                 $hasNameClashes = (count($skinNameClashes) > 0) || (count($templateNameClashes) > 0);
3520
3521                 if ($error) $this->error($error);
3522
3523                 $this->pagehead();
3524
3525                 echo '<p><a href="index.php?action=skinieoverview">(',_BACK,')</a></p>';
3526                 ?>
3527                 <h2><?php echo _SKINIE_CONFIRM_TITLE?></h2>
3528
3529                 <ul>
3530                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3531                         <li><p><strong><?php echo _SKINIE_INFO_SKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3532                         <li><p><strong><?php echo _SKINIE_INFO_TEMPLATES?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3533                         <?php
3534                                 if ($hasNameClashes)
3535                                 {
3536                         ?>
3537                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_SKINCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$skinNameClashes)?></p></li>
3538                         <li><p><strong style="color: red;"><?php echo _SKINIE_INFO_TEMPLCLASH?></strong> <?php echo implode(' <em>'._AND.'</em> ',$templateNameClashes)?></p></li>
3539                         <?php
3540                                 } // if (hasNameClashes)
3541                         ?>
3542                 </ul>
3543
3544                 <form method="post" action="index.php"><div>
3545                         <input type="hidden" name="action" value="skiniedoimport" />
3546                         <?php $manager->addTicketHidden() ?>
3547                         <input type="hidden" name="skinfile" value="<?php echo htmlspecialchars(postVar('skinfile'))?>" />
3548                         <input type="hidden" name="mode" value="<?php echo htmlspecialchars($mode)?>" />
3549                         <input type="submit" value="<?php echo _SKINIE_CONFIRM_IMPORT?>" />
3550                         <?php
3551                                 if ($hasNameClashes)
3552                                 {
3553                         ?>
3554                         <br />
3555                         <input type="checkbox" name="overwrite" value="1" id="cb_overwrite" /><label for="cb_overwrite"><?php echo _SKINIE_CONFIRM_OVERWRITE?></label>
3556                         <?php
3557                                 } // if (hasNameClashes)
3558                         ?>
3559                 </div></form>
3560
3561
3562                 <?php
3563                 $this->pagefoot();
3564         }
3565
3566         /**
3567          * @todo document this
3568          */
3569         function action_skiniedoimport() {
3570                 global $member, $DIR_LIBS, $DIR_SKINS;
3571
3572                 $member->isAdmin() or $this->disallow();
3573
3574                 // load skinie class
3575                 include_once($DIR_LIBS . 'skinie.php');
3576
3577                 $skinFileRaw= postVar('skinfile');
3578                 $mode           = postVar('mode');
3579
3580                 $allowOverwrite = intPostVar('overwrite');
3581
3582                 // get full filename
3583                 if ($mode == 'file')
3584                 {
3585                         $skinFile = $DIR_SKINS . $skinFileRaw . '/skinbackup.xml';
3586
3587                         // backwards compatibilty (in v2.0, exports were saved as skindata.xml)
3588                         if (!file_exists($skinFile))
3589                                 $skinFile = $DIR_SKINS . $skinFileRaw . '/skindata.xml';
3590
3591                 } else {
3592                         $skinFile = $skinFileRaw;
3593                 }
3594
3595                 $importer =& new SKINIMPORT();
3596
3597                 $error = $importer->readFile($skinFile);
3598
3599                 if ($error)
3600                         $this->error($error);
3601
3602                 $error = $importer->writeToDatabase($allowOverwrite);
3603
3604                 if ($error)
3605                         $this->error($error);
3606
3607                 $this->pagehead();
3608
3609                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3610         ?>
3611                 <h2><?php echo _SKINIE_DONE?></h2>
3612
3613                 <ul>
3614                         <li><p><strong><?php echo _SKINIE_INFO_GENERAL?></strong> <?php echo htmlspecialchars($importer->getInfo())?></p></li>
3615                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDSKINS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getSkinNames())?></p></li>
3616                         <li><p><strong><?php echo _SKINIE_INFO_IMPORTEDTEMPLS?></strong> <?php echo implode(' <em>'._AND.'</em> ',$importer->getTemplateNames())?></p></li>
3617                 </ul>
3618
3619         <?php           $this->pagefoot();
3620
3621         }
3622
3623         /**
3624          * @todo document this
3625          */
3626         function action_skinieexport() {
3627                 global $member, $DIR_LIBS;
3628
3629                 $member->isAdmin() or $this->disallow();
3630
3631                 // load skinie class
3632                 include_once($DIR_LIBS . 'skinie.php');
3633
3634                 $aSkins = requestIntArray('skin');
3635                 $aTemplates = requestIntArray('template');
3636
3637                 if (!is_array($aTemplates)) $aTemplates = array();
3638                 if (!is_array($aSkins)) $aSkins = array();
3639
3640                 $skinList = array_keys($aSkins);
3641                 $templateList = array_keys($aTemplates);
3642
3643                 $info = postVar('info');
3644
3645                 $exporter =& new SKINEXPORT();
3646                 foreach ($skinList as $skinId) {
3647                         $exporter->addSkin($skinId);
3648                 }
3649                 foreach ($templateList as $templateId) {
3650                         $exporter->addTemplate($templateId);
3651                 }
3652                 $exporter->setInfo($info);
3653
3654                 $exporter->export();
3655         }
3656
3657         /**
3658          * @todo document this
3659          */
3660         function action_templateoverview() {
3661                 global $member, $manager;
3662
3663                 $member->isAdmin() or $this->disallow();
3664
3665                 $this->pagehead();
3666
3667                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
3668
3669                 echo '<h2>' . _TEMPLATE_TITLE . '</h2>';
3670                 echo '<h3>' . _TEMPLATE_AVAILABLE_TITLE . '</h3>';
3671
3672                 $query = 'SELECT * FROM '.sql_table('template_desc').' ORDER BY tdname';
3673                 $template['content'] = 'templatelist';
3674                 $template['tabindex'] = 10;
3675                 showlist($query,'table',$template);
3676
3677                 echo '<h3>' . _TEMPLATE_NEW_TITLE . '</h3>';
3678
3679                 ?>
3680                 <form method="post" action="index.php"><div>
3681
3682                 <input name="action" value="templatenew" type="hidden" />
3683                 <?php $manager->addTicketHidden() ?>
3684                 <table><tr>
3685                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3686                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
3687                 </tr><tr>
3688                         <td><?php echo _TEMPLATE_DESC?></td>
3689                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
3690                 </tr><tr>
3691                         <td><?php echo _TEMPLATE_CREATE?></td>
3692                         <td><input type="submit" tabindex="10030" value="<?php echo _TEMPLATE_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
3693                 </tr></table>
3694
3695                 </div></form>
3696
3697                 <?php
3698                 $this->pagefoot();
3699         }
3700
3701         /**
3702          * @todo document this
3703          */
3704         function action_templateedit($msg = '') {
3705                 global $member, $manager;
3706
3707                 $templateid = intRequestVar('templateid');
3708
3709                 $member->isAdmin() or $this->disallow();
3710
3711                 $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
3712                 $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
3713
3714                 $this->pagehead($extrahead);
3715
3716                 $templatename = TEMPLATE::getNameFromId($templateid);
3717                 $templatedescription = TEMPLATE::getDesc($templateid);
3718                 $template =& $manager->getTemplate($templatename);
3719
3720                 ?>
3721                 <p>
3722                 <a href="index.php?action=templateoverview">(<?php echo _TEMPLATE_BACK?>)</a>
3723                 </p>
3724
3725                 <h2><?php echo _TEMPLATE_EDIT_TITLE?> '<?php echo  $templatename; ?>'</h2>
3726
3727                 <?php                                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
3728                 ?>
3729
3730                 <p><?php echo _TEMPLATE_EDIT_MSG?></p>
3731
3732                 <form method="post" action="index.php">
3733                 <div>
3734
3735                 <input type="hidden" name="action" value="templateupdate" />
3736                 <?php $manager->addTicketHidden() ?>
3737                 <input type="hidden" name="templateid" value="<?php echo  $templateid; ?>" />
3738
3739                 <table><tr>
3740                         <th colspan="2"><?php echo _TEMPLATE_SETTINGS?></th>
3741                 </tr><tr>
3742                         <td><?php echo _TEMPLATE_NAME?> <?php help('shortnames');?></td>
3743                         <td><input name="tname" tabindex="4" size="20" maxlength="20" value="<?php echo  htmlspecialchars($templatename) ?>" /></td>
3744                 </tr><tr>
3745                         <td><?php echo _TEMPLATE_DESC?></td>
3746                         <td><input name="tdesc" tabindex="5" size="50" maxlength="200" value="<?php echo  htmlspecialchars($templatedescription) ?>" /></td>
3747                 </tr><tr>
3748                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3749                 </tr><tr>
3750                         <td><?php echo _TEMPLATE_UPDATE?></td>
3751                         <td>
3752                                 <input type="submit" tabindex="6" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3753                                 <input type="reset" tabindex="7" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3754                         </td>
3755                 </tr><tr>
3756                         <th colspan="2"><?php echo _TEMPLATE_ITEMS?> <?php help('templateitems'); ?></th>
3757 <?php   $this->_templateEditRow($template, _TEMPLATE_ITEMHEADER, 'ITEM_HEADER', '', 8);
3758         $this->_templateEditRow($template, _TEMPLATE_ITEMBODY, 'ITEM', '', 9, 1);
3759         $this->_templateEditRow($template, _TEMPLATE_ITEMFOOTER, 'ITEM_FOOTER', '', 10);
3760         $this->_templateEditRow($template, _TEMPLATE_MORELINK, 'MORELINK', 'morelink', 20);
3761         $this->_templateEditRow($template, _TEMPLATE_EDITLINK, 'EDITLINK', 'editlink', 25);
3762         $this->_templateEditRow($template, _TEMPLATE_NEW, 'NEW', 'new', 30);
3763 ?>
3764                 </tr><tr>
3765                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_ANY?> <?php help('templatecomments'); ?></th>
3766 <?php   $this->_templateEditRow($template, _TEMPLATE_CHEADER, 'COMMENTS_HEADER', 'commentheaders', 40);
3767         $this->_templateEditRow($template, _TEMPLATE_CBODY, 'COMMENTS_BODY', 'commentbody', 50, 1);
3768         $this->_templateEditRow($template, _TEMPLATE_CFOOTER, 'COMMENTS_FOOTER', 'commentheaders', 60);
3769         $this->_templateEditRow($template, _TEMPLATE_CONE, 'COMMENTS_ONE', 'commentwords', 70);
3770         $this->_templateEditRow($template, _TEMPLATE_CMANY, 'COMMENTS_MANY', 'commentwords', 80);
3771         $this->_templateEditRow($template, _TEMPLATE_CMORE, 'COMMENTS_CONTINUED', 'commentcontinued', 90);
3772         $this->_templateEditRow($template, _TEMPLATE_CMEXTRA, 'COMMENTS_AUTH', 'memberextra', 100);
3773 ?>
3774                 </tr><tr>
3775                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_NONE?> <?php help('templatecomments'); ?></th>
3776 <?php
3777         $this->_templateEditRow($template, _TEMPLATE_CNONE, 'COMMENTS_NONE', '', 110);
3778 ?>
3779                 </tr><tr>
3780                         <th colspan="2"><?php echo _TEMPLATE_COMMENTS_TOOMUCH?> <?php help('templatecomments'); ?></th>
3781 <?php   $this->_templateEditRow($template, _TEMPLATE_CTOOMUCH, 'COMMENTS_TOOMUCH', '', 120);
3782 ?>
3783                 </tr><tr>
3784                         <th colspan="2"><?php echo _TEMPLATE_ARCHIVELIST?> <?php help('templatearchivelists'); ?></th>
3785 <?php   $this->_templateEditRow($template, _TEMPLATE_AHEADER, 'ARCHIVELIST_HEADER', '', 130);
3786         $this->_templateEditRow($template, _TEMPLATE_AITEM, 'ARCHIVELIST_LISTITEM', '', 140);
3787         $this->_templateEditRow($template, _TEMPLATE_AFOOTER, 'ARCHIVELIST_FOOTER', '', 150);
3788 ?>
3789                 </tr><tr>
3790                         <th colspan="2"><?php echo _TEMPLATE_CATEGORYLIST?> <?php help('templatecategorylists'); ?></th>
3791 <?php   $this->_templateEditRow($template, _TEMPLATE_CATHEADER, 'CATLIST_HEADER', '', 160);
3792         $this->_templateEditRow($template, _TEMPLATE_CATITEM, 'CATLIST_LISTITEM', '', 170);
3793         $this->_templateEditRow($template, _TEMPLATE_CATFOOTER, 'CATLIST_FOOTER', '', 180);
3794 ?>
3795                 </tr><tr>
3796                         <th colspan="2"><?php echo _TEMPLATE_DATETIME?></th>
3797 <?php   $this->_templateEditRow($template, _TEMPLATE_DHEADER, 'DATE_HEADER', 'dateheads', 190);
3798         $this->_templateEditRow($template, _TEMPLATE_DFOOTER, 'DATE_FOOTER', 'dateheads', 200);
3799         $this->_templateEditRow($template, _TEMPLATE_DFORMAT, 'FORMAT_DATE', 'datetime', 210);
3800         $this->_templateEditRow($template, _TEMPLATE_TFORMAT, 'FORMAT_TIME', 'datetime', 220);
3801         $this->_templateEditRow($template, _TEMPLATE_LOCALE, 'LOCALE', 'locale', 230);
3802 ?>
3803                 </tr><tr>
3804                         <th colspan="2"><?php echo _TEMPLATE_IMAGE?> <?php help('templatepopups'); ?></th>
3805 <?php   $this->_templateEditRow($template, _TEMPLATE_PCODE, 'POPUP_CODE', '', 240);
3806         $this->_templateEditRow($template, _TEMPLATE_ICODE, 'IMAGE_CODE', '', 250);
3807         $this->_templateEditRow($template, _TEMPLATE_MCODE, 'MEDIA_CODE', '', 260);
3808 ?>
3809                 </tr><tr>
3810                         <th colspan="2"><?php echo _TEMPLATE_SEARCH?></th>
3811 <?php   $this->_templateEditRow($template, _TEMPLATE_SHIGHLIGHT, 'SEARCH_HIGHLIGHT', 'highlight',270);
3812         $this->_templateEditRow($template, _TEMPLATE_SNOTFOUND, 'SEARCH_NOTHINGFOUND', 'nothingfound',280);
3813 ?>
3814                 </tr><tr>
3815                         <th colspan="2"><?php echo _TEMPLATE_UPDATE?></th>
3816                 </tr><tr>
3817                         <td><?php echo _TEMPLATE_UPDATE?></td>
3818                         <td>
3819                                 <input type="submit" tabindex="290" value="<?php echo _TEMPLATE_UPDATE_BTN?>" onclick="return checkSubmit();" />
3820                                 <input type="reset" tabindex="300" value="<?php echo _TEMPLATE_RESET_BTN?>" />
3821                         </td>
3822                 </tr></table>
3823
3824                 </div>
3825                 </form>
3826                 <?php
3827                 $this->pagefoot();
3828         }
3829
3830         /**
3831          * @todo document this
3832          */
3833         function _templateEditRow(&$template, $description, $name, $help = '', $tabindex = 0, $big = 0) {
3834                 static $count = 1;
3835         ?>
3836                 </tr><tr>
3837                         <td><?php echo $description?> <?php if ($help) help('template'.$help); ?></td>
3838                         <td id="td<?php echo $count?>"><textarea class="templateedit" name="<?php echo $name?>" tabindex="<?php echo $tabindex?>" cols="50" rows="<?php echo $big?10:5?>" id="textarea<?php echo $count?>"><?php echo  htmlspecialchars($template[$name]); ?></textarea></td>
3839         <?php           $count++;
3840         }
3841
3842         /**
3843          * @todo document this
3844          */
3845         function action_templateupdate() {
3846                 global $member;
3847
3848                 $templateid = intRequestVar('templateid');
3849
3850                 $member->isAdmin() or $this->disallow();
3851
3852                 $name = postVar('tname');
3853                 $desc = postVar('tdesc');
3854
3855                 if (!isValidTemplateName($name))
3856                         $this->error(_ERROR_BADTEMPLATENAME);
3857
3858                 if ((TEMPLATE::getNameFromId($templateid) != $name) && TEMPLATE::exists($name))
3859                         $this->error(_ERROR_DUPTEMPLATENAME);
3860
3861
3862                 $name = addslashes($name);
3863                 $desc = addslashes($desc);
3864
3865                 // 1. Remove all template parts
3866                 $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
3867                 sql_query($query);
3868
3869                 // 2. Update description
3870                 $query =  'UPDATE '.sql_table('template_desc').' SET'
3871                            . " tdname='" . $name . "',"
3872                            . " tddesc='" . $desc . "'"
3873                            . " WHERE tdnumber=" . $templateid;
3874                 sql_query($query);
3875
3876                 // 3. Add non-empty template parts
3877                 $this->addToTemplate($templateid, 'ITEM_HEADER', postVar('ITEM_HEADER'));
3878                 $this->addToTemplate($templateid, 'ITEM', postVar('ITEM'));
3879                 $this->addToTemplate($templateid, 'ITEM_FOOTER', postVar('ITEM_FOOTER'));
3880                 $this->addToTemplate($templateid, 'MORELINK', postVar('MORELINK'));
3881                 $this->addToTemplate($templateid, 'EDITLINK', postVar('EDITLINK'));
3882                 $this->addToTemplate($templateid, 'NEW', postVar('NEW'));
3883                 $this->addToTemplate($templateid, 'COMMENTS_HEADER', postVar('COMMENTS_HEADER'));
3884                 $this->addToTemplate($templateid, 'COMMENTS_BODY', postVar('COMMENTS_BODY'));
3885                 $this->addToTemplate($templateid, 'COMMENTS_FOOTER', postVar('COMMENTS_FOOTER'));
3886                 $this->addToTemplate($templateid, 'COMMENTS_CONTINUED', postVar('COMMENTS_CONTINUED'));
3887                 $this->addToTemplate($templateid, 'COMMENTS_TOOMUCH', postVar('COMMENTS_TOOMUCH'));
3888                 $this->addToTemplate($templateid, 'COMMENTS_AUTH', postVar('COMMENTS_AUTH'));
3889                 $this->addToTemplate($templateid, 'COMMENTS_ONE', postVar('COMMENTS_ONE'));
3890                 $this->addToTemplate($templateid, 'COMMENTS_MANY', postVar('COMMENTS_MANY'));
3891                 $this->addToTemplate($templateid, 'COMMENTS_NONE', postVar('COMMENTS_NONE'));
3892                 $this->addToTemplate($templateid, 'ARCHIVELIST_HEADER', postVar('ARCHIVELIST_HEADER'));
3893                 $this->addToTemplate($templateid, 'ARCHIVELIST_LISTITEM', postVar('ARCHIVELIST_LISTITEM'));
3894                 $this->addToTemplate($templateid, 'ARCHIVELIST_FOOTER', postVar('ARCHIVELIST_FOOTER'));
3895                 $this->addToTemplate($templateid, 'CATLIST_HEADER', postVar('CATLIST_HEADER'));
3896                 $this->addToTemplate($templateid, 'CATLIST_LISTITEM', postVar('CATLIST_LISTITEM'));
3897                 $this->addToTemplate($templateid, 'CATLIST_FOOTER', postVar('CATLIST_FOOTER'));
3898                 $this->addToTemplate($templateid, 'DATE_HEADER', postVar('DATE_HEADER'));
3899                 $this->addToTemplate($templateid, 'DATE_FOOTER', postVar('DATE_FOOTER'));
3900                 $this->addToTemplate($templateid, 'FORMAT_DATE', postVar('FORMAT_DATE'));
3901                 $this->addToTemplate($templateid, 'FORMAT_TIME', postVar('FORMAT_TIME'));
3902                 $this->addToTemplate($templateid, 'LOCALE', postVar('LOCALE'));
3903                 $this->addToTemplate($templateid, 'SEARCH_HIGHLIGHT', postVar('SEARCH_HIGHLIGHT'));
3904                 $this->addToTemplate($templateid, 'SEARCH_NOTHINGFOUND', postVar('SEARCH_NOTHINGFOUND'));
3905                 $this->addToTemplate($templateid, 'POPUP_CODE', postVar('POPUP_CODE'));
3906                 $this->addToTemplate($templateid, 'MEDIA_CODE', postVar('MEDIA_CODE'));
3907                 $this->addToTemplate($templateid, 'IMAGE_CODE', postVar('IMAGE_CODE'));
3908
3909
3910                 // jump back to template edit
3911                 $this->action_templateedit(_TEMPLATE_UPDATED);
3912
3913         }
3914
3915         /**
3916          * @todo document this
3917          */
3918         function addToTemplate($id, $partname, $content) {
3919                 $partname = addslashes($partname);
3920                 $content = addslashes($content);
3921
3922                 $id = intval($id);
3923
3924                 // don't add empty parts:
3925                 if (!trim($content)) return -1;
3926
3927                 $query = 'INSERT INTO '.sql_table('template')." (tdesc, tpartname, tcontent) "
3928                            . "VALUES ($id, '$partname', '$content')";
3929                 sql_query($query) or die("Query error: " . mysql_error());
3930                 return mysql_insert_id();
3931         }
3932
3933         /**
3934          * @todo document this
3935          */
3936         function action_templatedelete() {
3937                 global $member, $manager;
3938
3939                 $member->isAdmin() or $this->disallow();
3940
3941                 $templateid = intRequestVar('templateid');
3942                 // TODO: check if template can be deleted
3943
3944                 $this->pagehead();
3945
3946                 $name = TEMPLATE::getNameFromId($templateid);
3947                 $desc = TEMPLATE::getDesc($templateid);
3948
3949                 ?>
3950                         <h2><?php echo _DELETE_CONFIRM?></h2>
3951
3952                         <p>
3953                         <?php echo _CONFIRMTXT_TEMPLATE?><b><?php echo $name?></b> (<?php echo  htmlspecialchars($desc) ?>)
3954                         </p>
3955
3956                         <form method="post" action="index.php"><div>
3957                                 <input type="hidden" name="action" value="templatedeleteconfirm" />
3958                                 <?php $manager->addTicketHidden() ?>
3959                                 <input type="hidden" name="templateid" value="<?php echo  $templateid ?>" />
3960                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
3961                         </div></form>
3962                 <?php
3963                 $this->pagefoot();
3964         }
3965
3966         /**
3967          * @todo document this
3968          */
3969         function action_templatedeleteconfirm() {
3970                 global $member, $manager;
3971
3972                 $templateid = intRequestVar('templateid');
3973
3974                 $member->isAdmin() or $this->disallow();
3975
3976                 $manager->notify('PreDeleteTemplate', array('templateid' => $templateid));
3977
3978                 // 1. delete description
3979                 sql_query('DELETE FROM '.sql_table('template_desc').' WHERE tdnumber=' . $templateid);
3980
3981                 // 2. delete parts
3982                 sql_query('DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
3983
3984                 $manager->notify('PostDeleteTemplate', array('templateid' => $templateid));
3985
3986                 $this->action_templateoverview();
3987         }
3988
3989         /**
3990          * @todo document this
3991          */
3992         function action_templatenew() {
3993                 global $member;
3994
3995                 $member->isAdmin() or $this->disallow();
3996
3997                 $name = postVar('name');
3998                 $desc = postVar('desc');
3999
4000                 if (!isValidTemplateName($name))
4001                         $this->error(_ERROR_BADTEMPLATENAME);
4002
4003                 if (TEMPLATE::exists($name))
4004                         $this->error(_ERROR_DUPTEMPLATENAME);
4005
4006                 $newTemplateId = TEMPLATE::createNew($name, $desc);
4007
4008                 $this->action_templateoverview();
4009         }
4010
4011         /**
4012          * @todo document this
4013          */
4014         function action_templateclone() {
4015                 global $member;
4016
4017                 $templateid = intRequestVar('templateid');
4018
4019                 $member->isAdmin() or $this->disallow();
4020
4021                 // 1. read old template
4022                 $name = TEMPLATE::getNameFromId($templateid);
4023                 $desc = TEMPLATE::getDesc($templateid);
4024
4025                 // 2. create desc thing
4026                 $name = "cloned" . $name;
4027
4028                 // if a template with that name already exists:
4029                 if (TEMPLATE::exists($name)) {
4030                         $i = 1;
4031                         while (TEMPLATE::exists($name . $i))
4032                                 $i++;
4033                         $name .= $i;
4034                 }
4035
4036                 $newid = TEMPLATE::createNew($name, $desc);
4037
4038                 // 3. create clone
4039                 // go through parts of old template and add them to the new one
4040                 $res = sql_query('SELECT tpartname, tcontent FROM '.sql_table('template').' WHERE tdesc=' . $templateid);
4041                 while ($o = mysql_fetch_object($res)) {
4042                         $this->addToTemplate($newid, $o->tpartname, $o->tcontent);
4043                 }
4044
4045                 $this->action_templateoverview();
4046         }
4047
4048         /**
4049          * @todo document this
4050          */
4051         function action_skinoverview() {
4052                 global $member, $manager;
4053
4054                 $member->isAdmin() or $this->disallow();
4055
4056                 $this->pagehead();
4057
4058                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4059
4060                 echo '<h2>' . _SKIN_EDIT_TITLE . '</h2>';
4061
4062                 echo '<h3>' . _SKIN_AVAILABLE_TITLE . '</h3>';
4063
4064                 $query = 'SELECT * FROM '.sql_table('skin_desc').' ORDER BY sdname';
4065                 $template['content'] = 'skinlist';
4066                 $template['tabindex'] = 10;
4067                 showlist($query,'table',$template);
4068
4069                 echo '<h3>' . _SKIN_NEW_TITLE . '</h3>';
4070
4071                 ?>
4072                 <form method="post" action="index.php">
4073                 <div>
4074
4075                 <input name="action" value="skinnew" type="hidden" />
4076                 <?php $manager->addTicketHidden() ?>
4077                 <table><tr>
4078                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4079                         <td><input name="name" tabindex="10010" maxlength="20" size="20" /></td>
4080                 </tr><tr>
4081                         <td><?php echo _SKIN_DESC?></td>
4082                         <td><input name="desc" tabindex="10020" maxlength="200" size="50" /></td>
4083                 </tr><tr>
4084                         <td><?php echo _SKIN_CREATE?></td>
4085                         <td><input type="submit" tabindex="10030" value="<?php echo _SKIN_CREATE_BTN?>" onclick="return checkSubmit();" /></td>
4086                 </tr></table>
4087
4088                 </div>
4089                 </form>
4090
4091                 <?php
4092                 $this->pagefoot();
4093         }
4094
4095         /**
4096          * @todo document this
4097          */
4098         function action_skinnew() {
4099                 global $member;
4100
4101                 $member->isAdmin() or $this->disallow();
4102
4103                 $name = trim(postVar('name'));
4104                 $desc = trim(postVar('desc'));
4105
4106                 if (!isValidSkinName($name))
4107                         $this->error(_ERROR_BADSKINNAME);
4108
4109                 if (SKIN::exists($name))
4110                         $this->error(_ERROR_DUPSKINNAME);
4111
4112                 $newId = SKIN::createNew($name, $desc);
4113
4114                 $this->action_skinoverview();
4115         }
4116
4117         /**
4118          * @todo document this
4119          */
4120         function action_skinedit() {
4121                 global $member, $manager;
4122
4123                 $skinid = intRequestVar('skinid');
4124
4125                 $member->isAdmin() or $this->disallow();
4126
4127                 $skin =& new SKIN($skinid);
4128
4129                 $this->pagehead();
4130                 ?>
4131                 <p>
4132                         <a href="index.php?action=skinoverview">(<?php echo _SKIN_BACK?>)</a>
4133                 </p>
4134                 <h2><?php echo _SKIN_EDITONE_TITLE?> '<?php echo  $skin->getName() ?>'</h2>
4135
4136                 <h3><?php echo _SKIN_PARTS_TITLE?></h3>
4137                 <?php echo _SKIN_PARTS_MSG?>
4138                 <ul>
4139                         <li><a tabindex="10" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=index"><?php echo _SKIN_PART_MAIN?></a> <?php help('skinpartindex')?></li>
4140                         <li><a tabindex="20" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=item"><?php echo _SKIN_PART_ITEM?></a> <?php help('skinpartitem')?></li>
4141                         <li><a tabindex="30" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archivelist"><?php echo _SKIN_PART_ALIST?></a> <?php help('skinpartarchivelist')?></li>
4142                         <li><a tabindex="40" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=archive"><?php echo _SKIN_PART_ARCHIVE?></a> <?php help('skinpartarchive')?></li>
4143                         <li><a tabindex="50" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=search"><?php echo _SKIN_PART_SEARCH?></a> <?php help('skinpartsearch')?></li>
4144                         <li><a tabindex="60" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=error"><?php echo _SKIN_PART_ERROR?></a> <?php help('skinparterror')?></li>
4145                         <li><a tabindex="70" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=member"><?php echo _SKIN_PART_MEMBER?></a> <?php help('skinpartmember')?></li>
4146                         <li><a tabindex="75" href="index.php?action=skinedittype&amp;skinid=<?php echo  $skinid ?>&amp;type=imagepopup"><?php echo _SKIN_PART_POPUP?></a> <?php help('skinpartimagepopup')?></li>
4147                 </ul>
4148
4149                 <?php
4150
4151                 $query = "SELECT stype FROM " . sql_table('skin') . " WHERE stype NOT IN ('index', 'item', 'error', 'search', 'archive', 'archivelist', 'imagepopup', 'member') and sdesc = " . $skinid;
4152                 $res = sql_query($query);
4153
4154                 echo '<h3>' . _SKIN_PARTS_SPECIAL . '</h3>';
4155                 echo '<form method="get" action="index.php">' . "\r\n";
4156                 echo '<input type="hidden" name="action" value="skinedittype" />' . "\r\n";
4157                 echo '<input type="hidden" name="skinid" value="' . $skinid . '" />' . "\r\n";
4158                 echo '<input name="type" tabindex="89" size="20" maxlength="20" />' . "\r\n";
4159                 echo '<input type="submit" tabindex="140" value="' . _SKIN_CREATE . '" onclick="return checkSubmit();" />' . "\r\n";
4160                 echo '</form>' . "\r\n";
4161
4162                 if ($res && mysql_num_rows($res) > 0) {
4163                         echo '<ul>';
4164                         $tabstart = 75;
4165
4166                         while ($row = mysql_fetch_assoc($res)) {
4167                                 echo '<li><a tabindex="' . ($tabstart++) . '" href="index.php?action=skinedittype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">' . ucfirst($row['stype']) . '</a> (<a tabindex="' . ($tabstart++) . '" href="index.php?action=skinremovetype&amp;skinid=' . $skinid . '&amp;type=' . strtolower($row['stype']) . '">remove</a>)</li>';
4168                         }
4169
4170                         echo '</ul>';
4171                 }
4172
4173                 ?>
4174
4175                 <h3><?php echo _SKIN_GENSETTINGS_TITLE; ?></h3>
4176                 <form method="post" action="index.php">
4177                 <div>
4178
4179                 <input type="hidden" name="action" value="skineditgeneral" />
4180                 <?php $manager->addTicketHidden() ?>
4181                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4182                 <table><tr>
4183                         <td><?php echo _SKIN_NAME?> <?php help('shortnames');?></td>
4184                         <td><input name="name" tabindex="90" value="<?php echo  htmlspecialchars($skin->getName()) ?>" maxlength="20" size="20" /></td>
4185                 </tr><tr>
4186                         <td><?php echo _SKIN_DESC?></td>
4187                         <td><input name="desc" tabindex="100" value="<?php echo  htmlspecialchars($skin->getDescription()) ?>" maxlength="200" size="50" /></td>
4188                 </tr><tr>
4189                         <td><?php echo _SKIN_TYPE?></td>
4190                         <td><input name="type" tabindex="110" value="<?php echo  htmlspecialchars($skin->getContentType()) ?>" maxlength="40" size="20" /></td>
4191                 </tr><tr>
4192                         <td><?php echo _SKIN_INCLUDE_MODE?> <?php help('includemode')?></td>
4193                         <td><?php $this->input_yesno('inc_mode',$skin->getIncludeMode(),120,'skindir','normal',_PARSER_INCMODE_SKINDIR,_PARSER_INCMODE_NORMAL);?></td>
4194                 </tr><tr>
4195                         <td><?php echo _SKIN_INCLUDE_PREFIX?> <?php help('includeprefix')?></td>
4196                         <td><input name="inc_prefix" tabindex="130" value="<?php echo  htmlspecialchars($skin->getIncludePrefix()) ?>" maxlength="40" size="20" /></td>
4197                 </tr><tr>
4198                         <td><?php echo _SKIN_CHANGE?></td>
4199                         <td><input type="submit" tabindex="140" value="<?php echo _SKIN_CHANGE_BTN?>" onclick="return checkSubmit();" /></td>
4200                 </tr></table>
4201
4202                 </div>
4203                 </form>
4204
4205
4206                 <?php           $this->pagefoot();
4207         }
4208
4209         /**
4210          * @todo document this
4211          */
4212         function action_skineditgeneral() {
4213                 global $member;
4214
4215                 $skinid = intRequestVar('skinid');
4216
4217                 $member->isAdmin() or $this->disallow();
4218
4219                 $name = postVar('name');
4220                 $desc = postVar('desc');
4221                 $type = postVar('type');
4222                 $inc_mode = postVar('inc_mode');
4223                 $inc_prefix = postVar('inc_prefix');
4224
4225                 $skin =& new SKIN($skinid);
4226
4227                 // 1. Some checks
4228                 if (!isValidSkinName($name))
4229                         $this->error(_ERROR_BADSKINNAME);
4230
4231                 if (($skin->getName() != $name) && SKIN::exists($name))
4232                         $this->error(_ERROR_DUPSKINNAME);
4233
4234                 if (!$type) $type = 'text/html';
4235                 if (!$inc_mode) $inc_mode = 'normal';
4236
4237                 // 2. Update description
4238                 $skin->updateGeneralInfo($name, $desc, $type, $inc_mode, $inc_prefix);
4239
4240                 $this->action_skinedit();
4241
4242         }
4243
4244         /**
4245          * @todo document this
4246          */
4247         function action_skinedittype($msg = '') {
4248                 global $member, $manager;
4249
4250                 $skinid = intRequestVar('skinid');
4251                 $type = requestVar('type');
4252
4253                 $member->isAdmin() or $this->disallow();
4254
4255                 $type = trim($type);
4256                 $type = strtolower($type);
4257
4258                 if (!isValidShortName($type)) {
4259                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_FORMAT);
4260                 }
4261
4262                 $skin =& new SKIN($skinid);
4263
4264                 $friendlyNames = SKIN::getFriendlyNames();
4265
4266                 $this->pagehead();
4267                 ?>
4268                 <p>(<a href="index.php?action=skinoverview"><?php echo _SKIN_GOBACK?></a>)</p>
4269
4270                 <h2><?php echo _SKIN_EDITPART_TITLE?> '<?php echo  $skin->getName() ?>': <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?></h2>
4271
4272                 <?php                   if ($msg) echo "<p>"._MESSAGE.": $msg</p>";
4273                 ?>
4274
4275
4276                 <form method="post" action="index.php">
4277                 <div>
4278
4279                 <input type="hidden" name="action" value="skinupdate" />
4280                 <?php $manager->addTicketHidden() ?>
4281                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4282                 <input type="hidden" name="type" value="<?php echo  $type ?>" />
4283
4284                 <input type="submit" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4285                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4286                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4287                 <?php help('skinpart' . $type);?>
4288                 <br />
4289
4290                 <textarea class="skinedit" tabindex="10" rows="20" cols="80" name="content"><?php echo  htmlspecialchars($skin->getContent($type)) ?></textarea>
4291
4292                 <br />
4293                 <input type="submit" tabindex="20" value="<?php echo _SKIN_UPDATE_BTN?>" onclick="return checkSubmit();" />
4294                 <input type="reset" value="<?php echo _SKIN_RESET_BTN?>" />
4295                 (skin type: <?php echo (isset($friendlyNames[$type]) ? $friendlyNames[$type] : ucfirst($type)); ?>)
4296
4297                 <br /><br />
4298                 <?php echo _SKIN_ALLOWEDVARS?>
4299                 <?php                   $actions = SKIN::getAllowedActionsForType($type);
4300
4301                         sort($actions);
4302
4303                         while ($current = array_shift($actions)) {
4304                                 // skip deprecated vars
4305                                 if ($current == 'ifcat') continue;
4306                                 if ($current == 'imagetext') continue;
4307                                 if ($current == 'vars') continue;
4308
4309                                 echo helplink('skinvar-' . $current) . "$current</a>";
4310                                 if (count($actions) != 0) echo ", ";
4311                         }
4312                 ?>
4313                 <br /><br />
4314                 Short blog names:
4315                 <?php                   $query = 'SELECT bshortname, bname FROM '.sql_table('blog');
4316                         showlist($query,'table',array('content'=>'shortblognames'));
4317                 ?>
4318
4319                 <br />
4320                 Template names:
4321                 <?php                   $query = 'SELECT tdname as name, tddesc as description FROM '.sql_table('template_desc');
4322                         showlist($query,'table',array('content'=>'shortnames'));
4323                 ?>
4324
4325
4326                 </div>
4327                 </form>
4328
4329
4330                 <?php           $this->pagefoot();
4331         }
4332
4333         /**
4334          * @todo document this
4335          */
4336         function action_skinupdate() {
4337                 global $member;
4338
4339                 $skinid = intRequestVar('skinid');
4340                 $content = trim(postVar('content'));
4341                 $type = postVar('type');
4342
4343                 $member->isAdmin() or $this->disallow();
4344
4345                 $skin =& new SKIN($skinid);
4346                 $skin->update($type, $content);
4347
4348                 $this->action_skinedittype(_SKIN_UPDATED);
4349         }
4350
4351         /**
4352          * @todo document this
4353          */
4354         function action_skindelete() {
4355                 global $member, $manager, $CONF;
4356
4357                 $skinid = intRequestVar('skinid');
4358
4359                 $member->isAdmin() or $this->disallow();
4360
4361                 // don't allow default skin to be deleted
4362                 if ($skinid == $CONF['BaseSkin'])
4363                         $this->error(_ERROR_DEFAULTSKIN);
4364
4365                 // don't allow deletion of default skins for blogs
4366                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4367                 $r = sql_query($query);
4368                 if ($o = mysql_fetch_object($r))
4369                         $this->error(_ERROR_SKINDEFDELETE . $o->bname);
4370
4371                 $this->pagehead();
4372
4373                 $skin =& new SKIN($skinid);
4374                 $name = $skin->getName();
4375                 $desc = $skin->getDescription();
4376
4377                 ?>
4378                         <h2><?php echo _DELETE_CONFIRM?></h2>
4379
4380                         <p>
4381                                 <?php echo _CONFIRMTXT_SKIN?><b><?php echo  $name ?></b> (<?php echo  htmlspecialchars($desc)?>)
4382                         </p>
4383
4384                         <form method="post" action="index.php"><div>
4385                                 <input type="hidden" name="action" value="skindeleteconfirm" />
4386                                 <?php $manager->addTicketHidden() ?>
4387                                 <input type="hidden" name="skinid" value="<?php echo  $skinid ?>" />
4388                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4389                         </div></form>
4390                 <?php
4391                 $this->pagefoot();
4392         }
4393
4394         /**
4395          * @todo document this
4396          */
4397         function action_skindeleteconfirm() {
4398                 global $member, $CONF, $manager;
4399
4400                 $skinid = intRequestVar('skinid');
4401
4402                 $member->isAdmin() or $this->disallow();
4403
4404                 // don't allow default skin to be deleted
4405                 if ($skinid == $CONF['BaseSkin'])
4406                         $this->error(_ERROR_DEFAULTSKIN);
4407
4408                 // don't allow deletion of default skins for blogs
4409                 $query = 'SELECT bname FROM '.sql_table('blog').' WHERE bdefskin=' . $skinid;
4410                 $r = sql_query($query);
4411                 if ($o = mysql_fetch_object($r))
4412                         $this->error(_ERROR_SKINDEFDELETE .$o->bname);
4413
4414                 $manager->notify('PreDeleteSkin', array('skinid' => $skinid));
4415
4416                 // 1. delete description
4417                 sql_query('DELETE FROM '.sql_table('skin_desc').' WHERE sdnumber=' . $skinid);
4418
4419                 // 2. delete parts
4420                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid);
4421
4422                 $manager->notify('PostDeleteSkin', array('skinid' => $skinid));
4423
4424                 $this->action_skinoverview();
4425         }
4426
4427         /**
4428          * @todo document this
4429          */
4430         function action_skinremovetype() {
4431                 global $member, $manager, $CONF;
4432
4433                 $skinid = intRequestVar('skinid');
4434                 $skintype = requestVar('type');
4435
4436                 if (!isValidShortName($skintype)) {
4437                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4438                 }
4439
4440                 $member->isAdmin() or $this->disallow();
4441
4442                 // don't allow default skinparts to be deleted
4443                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4444                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4445                 }
4446
4447                 $this->pagehead();
4448
4449                 $skin =& new SKIN($skinid);
4450                 $name = $skin->getName();
4451                 $desc = $skin->getDescription();
4452
4453                 ?>
4454                         <h2><?php echo _DELETE_CONFIRM?></h2>
4455
4456                         <p>
4457                                 <?php echo _CONFIRMTXT_SKIN_PARTS_SPECIAL; ?> <b><?php echo $skintype; ?> (<?php echo $name; ?>)</b> (<?php echo  htmlspecialchars($desc)?>)
4458                         </p>
4459
4460                         <form method="post" action="index.php"><div>
4461                                 <input type="hidden" name="action" value="skinremovetypeconfirm" />
4462                                 <?php $manager->addTicketHidden() ?>
4463                                 <input type="hidden" name="skinid" value="<?php echo $skinid; ?>" />
4464                                 <input type="hidden" name="type" value="<?php echo $skintype; ?>" />
4465                                 <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
4466                         </div></form>
4467                 <?php
4468                 $this->pagefoot();
4469         }
4470
4471         /**
4472          * @todo document this
4473          */
4474         function action_skinremovetypeconfirm() {
4475                 global $member, $CONF, $manager;
4476
4477                 $skinid = intRequestVar('skinid');
4478                 $skintype = requestVar('type');
4479
4480                 if (!isValidShortName($skintype)) {
4481                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4482                 }
4483
4484                 $member->isAdmin() or $this->disallow();
4485
4486                 // don't allow default skinparts to be deleted
4487                 if (in_array($skintype, array('index', 'item', 'archivelist', 'archive', 'search', 'error', 'member', 'imagepopup'))) {
4488                         $this->error(_ERROR_SKIN_PARTS_SPECIAL_DELETE);
4489                 }
4490
4491                 $manager->notify('PreDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4492
4493                 // delete part
4494                 sql_query('DELETE FROM '.sql_table('skin').' WHERE sdesc=' . $skinid . ' AND stype=\'' . $skintype . '\'');
4495
4496                 $manager->notify('PostDeleteSkinPart', array('skinid' => $skinid, 'skintype' => $skintype));
4497
4498                 $this->action_skinedit();
4499         }
4500
4501         /**
4502          * @todo document this
4503          */
4504         function action_skinclone() {
4505                 global $member;
4506
4507                 $skinid = intRequestVar('skinid');
4508
4509                 $member->isAdmin() or $this->disallow();
4510
4511                 // 1. read skin to clone
4512                 $skin =& new SKIN($skinid);
4513
4514                 $name = "clone_" . $skin->getName();
4515
4516                 // if a skin with that name already exists:
4517                 if (SKIN::exists($name)) {
4518                         $i = 1;
4519                         while (SKIN::exists($name . $i))
4520                                 $i++;
4521                         $name .= $i;
4522                 }
4523
4524                 // 2. create skin desc
4525                 $newid = SKIN::createNew(
4526                         $name,
4527                         $skin->getDescription(),
4528                         $skin->getContentType(),
4529                         $skin->getIncludeMode(),
4530                         $skin->getIncludePrefix()
4531                 );
4532
4533
4534                 // 3. clone
4535                 /*
4536                 $this->skinclonetype($skin, $newid, 'index');
4537                 $this->skinclonetype($skin, $newid, 'item');
4538                 $this->skinclonetype($skin, $newid, 'archivelist');
4539                 $this->skinclonetype($skin, $newid, 'archive');
4540                 $this->skinclonetype($skin, $newid, 'search');
4541                 $this->skinclonetype($skin, $newid, 'error');
4542                 $this->skinclonetype($skin, $newid, 'member');
4543                 $this->skinclonetype($skin, $newid, 'imagepopup');
4544                 */
4545
4546                 $query = "SELECT stype FROM " . sql_table('nucleus_skin') . " WHERE sdesc = " . $skinid;
4547                 $res = sql_query($query);
4548                 while ($row = mysql_fetch_assoc($res)) {
4549                         $this->skinclonetype($skin, $newid, $row['stype']);
4550                 }
4551
4552                 $this->action_skinoverview();
4553
4554         }
4555
4556         /**
4557          * @todo document this
4558          */
4559         function skinclonetype($skin, $newid, $type) {
4560                 $newid = intval($newid);
4561                 $content = $skin->getContent($type);
4562                 if ($content) {
4563                         $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
4564                         sql_query($query);
4565                 }
4566         }
4567
4568         /**
4569          * @todo document this
4570          */
4571         function action_settingsedit() {
4572                 global $member, $manager, $CONF, $DIR_NUCLEUS, $DIR_MEDIA;
4573
4574                 $member->isAdmin() or $this->disallow();
4575
4576                 $this->pagehead();
4577
4578                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
4579                 ?>
4580
4581                 <h2><?php echo _SETTINGS_TITLE?></h2>
4582
4583                 <form action="index.php" method="post">
4584                 <div>
4585
4586                 <input type="hidden" name="action" value="settingsupdate" />
4587                 <?php $manager->addTicketHidden() ?>
4588
4589                 <table><tr>
4590                         <th colspan="2"><?php echo _SETTINGS_SUB_GENERAL?></th>
4591                 </tr><tr>
4592                         <td><?php echo _SETTINGS_DEFBLOG?> <?php help('defaultblog'); ?></td>
4593                         <td>
4594                                 <?php
4595                                         $query =  'SELECT bname as text, bnumber as value'
4596                                                    . ' FROM '.sql_table('blog');
4597                                         $template['name'] = 'DefaultBlog';
4598                                         $template['selected'] = $CONF['DefaultBlog'];
4599                                         $template['tabindex'] = 10;
4600                                         showlist($query,'select',$template);
4601                                 ?>
4602                         </td>
4603                 </tr><tr>
4604                         <td><?php echo _SETTINGS_BASESKIN?> <?php help('baseskin'); ?></td>
4605                         <td>
4606                                 <?php
4607                                         $query =  'SELECT sdname as text, sdnumber as value'
4608                                                    . ' FROM '.sql_table('skin_desc');
4609                                         $template['name'] = 'BaseSkin';
4610                                         $template['selected'] = $CONF['BaseSkin'];
4611                                         $template['tabindex'] = 1;
4612                                         showlist($query,'select',$template);
4613                                 ?>
4614                         </td>
4615                 </tr><tr>
4616                         <td><?php echo _SETTINGS_ADMINMAIL?></td>
4617                         <td><input name="AdminEmail" tabindex="10010" size="40" value="<?php echo  htmlspecialchars($CONF['AdminEmail']) ?>" /></td>
4618                 </tr><tr>
4619                         <td><?php echo _SETTINGS_SITENAME?></td>
4620                         <td><input name="SiteName" tabindex="10020" size="40" value="<?php echo  htmlspecialchars($CONF['SiteName']) ?>" /></td>
4621                 </tr><tr>
4622                         <td><?php echo _SETTINGS_SITEURL?></td>
4623                         <td><input name="IndexURL" tabindex="10030" size="40" value="<?php echo  htmlspecialchars($CONF['IndexURL']) ?>" /></td>
4624                 </tr><tr>
4625                         <td><?php echo _SETTINGS_ADMINURL?></td>
4626                         <td><input name="AdminURL" tabindex="10040" size="40" value="<?php echo  htmlspecialchars($CONF['AdminURL']) ?>" /></td>
4627                 </tr><tr>
4628                         <td><?php echo _SETTINGS_PLUGINURL?> <?php help('pluginurl');?></td>
4629                         <td><input name="PluginURL" tabindex="10045" size="40" value="<?php echo  htmlspecialchars($CONF['PluginURL']) ?>" /></td>
4630                 </tr><tr>
4631                         <td><?php echo _SETTINGS_SKINSURL?> <?php help('skinsurl');?></td>
4632                         <td><input name="SkinsURL" tabindex="10046" size="40" value="<?php echo  htmlspecialchars($CONF['SkinsURL']) ?>" /></td>
4633                 </tr><tr>
4634                         <td><?php echo _SETTINGS_ACTIONSURL?> <?php help('actionurl');?></td>
4635                         <td><input name="ActionURL" tabindex="10047" size="40" value="<?php echo  htmlspecialchars($CONF['ActionURL']) ?>" /></td>
4636                 </tr><tr>
4637                         <td><?php echo _SETTINGS_LANGUAGE?> <?php help('language'); ?>
4638                         </td>
4639                         <td>
4640
4641                                 <select name="Language" tabindex="10050">
4642                                 <?php                           // show a dropdown list of all available languages
4643                                 global $DIR_LANG;
4644                                 $dirhandle = opendir($DIR_LANG);
4645                                 while ($filename = readdir($dirhandle)) {
4646                                         if (ereg("^(.*)\.php$",$filename,$matches)) {
4647                                                 $name = $matches[1];
4648                                                 echo "<option value='$name'";
4649                                                 if ($name == $CONF['Language'])
4650                                                         echo " selected='selected'";
4651                                                 echo ">$name</option>";
4652                                         }
4653                                 }
4654                                 closedir($dirhandle);
4655
4656                                 ?>
4657                                 </select>
4658
4659                         </td>
4660                 </tr><tr>
4661                         <td><?php echo _SETTINGS_DISABLESITE?> <?php help('disablesite'); ?>
4662                         </td>
4663                         <td><?php $this->input_yesno('DisableSite',$CONF['DisableSite'],10060); ?>
4664                                         <br />
4665                                 URL: <input name="DisableSiteURL" tabindex="10070" size="40" value="<?php echo  htmlspecialchars($CONF['DisableSiteURL'])?>" />
4666                         </td>
4667                 </tr><tr>
4668                         <td><?php echo _SETTINGS_DIRS?></td>
4669                         <td><?php echo  htmlspecialchars($DIR_NUCLEUS) ?>
4670                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4671                 </tr><tr>
4672                         <td><?php echo _SETTINGS_DBLOGIN?></td>
4673                         <td><i><?php echo _SETTINGS_SEECONFIGPHP?></i></td>
4674                 </tr><tr>
4675                         <td>
4676                         <?php
4677                                 echo _SETTINGS_JSTOOLBAR
4678                                 /* =_SETTINGS_DISABLEJS
4679
4680                                         I temporary changed the meaning of DisableJsTools, until I can find a good
4681                                         way to select the javascript version to use
4682
4683                                         now, its:
4684                                                 0 : IE
4685                                                 1 : all javascript disabled
4686                                                 2 : 'simpler' javascript (for mozilla/opera/mac)
4687                                 */
4688                            ?>
4689                         </td>
4690                         <td><?php /* $this->input_yesno('DisableJsTools',$CONF['DisableJsTools'],10075); */?>
4691                                 <select name="DisableJsTools" tabindex="10075">
4692                         <?php                                   $extra = ($CONF['DisableJsTools'] == 1) ? 'selected="selected"' : '';
4693                                         echo "<option $extra value='1'>",_SETTINGS_JSTOOLBAR_NONE,"</option>";
4694                                         $extra = ($CONF['DisableJsTools'] == 2) ? 'selected="selected"' : '';
4695                                         echo "<option $extra value='2'>",_SETTINGS_JSTOOLBAR_SIMPLE,"</option>";
4696                                         $extra = ($CONF['DisableJsTools'] == 0) ? 'selected="selected"' : '';
4697                                         echo "<option $extra value='0'>",_SETTINGS_JSTOOLBAR_FULL,"</option>";
4698                         ?>
4699                                 </select>
4700                         </td>
4701                 </tr><tr>
4702                         <td><?php echo _SETTINGS_URLMODE?> <?php help('urlmode');?></td>
4703                                            <td><?php
4704
4705                                            $this->input_yesno('URLMode',$CONF['URLMode'],10077,
4706                                                           'normal','pathinfo',_SETTINGS_URLMODE_NORMAL,_SETTINGS_URLMODE_PATHINFO);
4707
4708                                            echo ' ', _SETTINGS_URLMODE_HELP;
4709
4710                                                          ?>
4711
4712                                            </td>
4713                 </tr><tr>
4714                         <th colspan="2"><?php echo _SETTINGS_MEDIA?> <?php help('media'); ?></th>
4715                 </tr><tr>
4716                         <td><?php echo _SETTINGS_MEDIADIR?></td>
4717                         <td><?php echo  htmlspecialchars($DIR_MEDIA) ?>
4718                                 <i><?php echo _SETTINGS_SEECONFIGPHP?></i>
4719                                 <?php                           if (!is_dir($DIR_MEDIA))
4720                                                 echo "<br /><b>" . _WARNING_NOTADIR . "</b>";
4721                                         if (!is_readable($DIR_MEDIA))
4722                                                 echo "<br /><b>" . _WARNING_NOTREADABLE . "</b>";
4723                                         if (!is_writeable($DIR_MEDIA))
4724                                                 echo "<br /><b>" . _WARNING_NOTWRITABLE . "</b>";
4725                                 ?>
4726                         </td>
4727                 </tr><tr>
4728                         <td><?php echo _SETTINGS_MEDIAURL?></td>
4729                         <td>
4730                                 <input name="MediaURL" tabindex="10080" size="40" value="<?php echo  htmlspecialchars($CONF['MediaURL']) ?>" />
4731                         </td>
4732                 </tr><tr>
4733                         <td><?php echo _SETTINGS_ALLOWUPLOAD?></td>
4734                         <td><?php $this->input_yesno('AllowUpload',$CONF['AllowUpload'],10090); ?></td>
4735                 </tr><tr>
4736                         <td><?php echo _SETTINGS_ALLOWUPLOADTYPES?></td>
4737                         <td>
4738                                 <input name="AllowedTypes" tabindex="10100" size="40" value="<?php echo  htmlspecialchars($CONF['AllowedTypes']) ?>" />
4739                         </td>
4740                 </tr><tr>
4741                         <td><?php echo _SETTINGS_MAXUPLOADSIZE?></td>
4742                         <td>
4743                                 <input name="MaxUploadSize" tabindex="10105" size="40" value="<?php echo  htmlspecialchars($CONF['MaxUploadSize']) ?>" />
4744                         </td>
4745                 </tr><tr>
4746                         <td><?php echo _SETTINGS_MEDIAPREFIX?></td>
4747                         <td><?php $this->input_yesno('MediaPrefix',$CONF['MediaPrefix'],10110); ?></td>
4748
4749                 </tr><tr>
4750                         <th colspan="2"><?php echo _SETTINGS_MEMBERS?></th>
4751                 </tr><tr>
4752                         <td><?php echo _SETTINGS_CHANGELOGIN?></td>
4753                         <td><?php $this->input_yesno('AllowLoginEdit',$CONF['AllowLoginEdit'],10120); ?></td>
4754                 </tr><tr>
4755                         <td><?php echo _SETTINGS_ALLOWCREATE?>
4756                                 <?php help('allowaccountcreation'); ?>
4757                         </td>
4758                         <td><?php $this->input_yesno('AllowMemberCreate',$CONF['AllowMemberCreate'],10130); ?>
4759                         </td>
4760                 </tr><tr>
4761                         <td><?php echo _SETTINGS_NEWLOGIN?> <?php help('allownewmemberlogin'); ?>
4762                                 <br /><?php echo _SETTINGS_NEWLOGIN2?>
4763                         </td>
4764                         <td><?php $this->input_yesno('NewMemberCanLogon',$CONF['NewMemberCanLogon'],10140); ?>
4765                         </td>
4766                 </tr><tr>
4767                         <td><?php echo _SETTINGS_MEMBERMSGS?>
4768                                 <?php help('messageservice'); ?>
4769                         </td>
4770                         <td><?php $this->input_yesno('AllowMemberMail',$CONF['AllowMemberMail'],10150); ?>
4771                         </td>
4772                 </tr><tr>
4773                         <td><?php echo _SETTINGS_NONMEMBERMSGS?>
4774                                 <?php help('messageservice'); ?>
4775                         </td>
4776                         <td><?php $this->input_yesno('NonmemberMail',$CONF['NonmemberMail'],10155); ?>
4777                         </td>
4778                 </tr><tr>
4779                         <td><?php echo _SETTINGS_PROTECTMEMNAMES?>
4780                                 <?php help('protectmemnames'); ?>
4781                         </td>
4782                         <td><?php $this->input_yesno('ProtectMemNames',$CONF['ProtectMemNames'],10156); ?>
4783                         </td>
4784
4785
4786
4787                 </tr><tr>
4788                         <th colspan="2"><?php echo _SETTINGS_COOKIES_TITLE?> <?php help('cookies'); ?></th>
4789                 </tr><tr>
4790                         <td><?php echo _SETTINGS_COOKIEPREFIX?></td>
4791                         <td><input name="CookiePrefix" tabindex="10159" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePrefix'])?>" /></td>
4792                 </tr><tr>
4793                         <td><?php echo _SETTINGS_COOKIEDOMAIN?></td>
4794                         <td><input name="CookieDomain" tabindex="10160" size="40" value="<?php echo  htmlspecialchars($CONF['CookieDomain'])?>" /></td>
4795                 </tr><tr>
4796                         <td><?php echo _SETTINGS_COOKIEPATH?></td>
4797                         <td><input name="CookiePath" tabindex="10170" size="40" value="<?php echo  htmlspecialchars($CONF['CookiePath'])?>" /></td>
4798                 </tr><tr>
4799                         <td><?php echo _SETTINGS_COOKIESECURE?></td>
4800                         <td><?php $this->input_yesno('CookieSecure',$CONF['CookieSecure'],10180); ?></td>
4801                 </tr><tr>
4802                         <td><?php echo _SETTINGS_COOKIELIFE?></td>
4803                         <td><?php $this->input_yesno('SessionCookie',$CONF['SessionCookie'],10190,
4804                                                           1,0,_SETTINGS_COOKIESESSION,_SETTINGS_COOKIEMONTH); ?>
4805                         </td>
4806                 </tr><tr>
4807                         <td><?php echo _SETTINGS_LASTVISIT?></td>
4808                         <td><?php $this->input_yesno('LastVisit',$CONF['LastVisit'],10200); ?></td>
4809
4810
4811
4812                 </tr><tr>
4813                         <th colspan="2"><?php echo _SETTINGS_UPDATE?></th>
4814                 </tr><tr>
4815                         <td><?php echo _SETTINGS_UPDATE?></td>
4816                         <td><input type="submit" tabindex="10210" value="<?php echo _SETTINGS_UPDATE_BTN?>" onclick="return checkSubmit();" /></td>
4817                 </tr></table>
4818
4819                 </div>
4820                 </form>
4821
4822                 <?php
4823                         echo '<h2>',_PLUGINS_EXTRA,'</h2>';
4824
4825                         $manager->notify(
4826                                 'GeneralSettingsFormExtras',
4827                                 array()
4828                         );
4829
4830                 $this->pagefoot();
4831         }
4832
4833         /**
4834          * @todo document this
4835          */
4836         function action_settingsupdate() {
4837                 global $member, $CONF;
4838
4839                 $member->isAdmin() or $this->disallow();
4840
4841                 // check if email address for admin is valid
4842                 if (!isValidMailAddress(postVar('AdminEmail')))
4843                         $this->error(_ERROR_BADMAILADDRESS);
4844
4845
4846                 // save settings
4847                 $this->updateConfig('DefaultBlog',              postVar('DefaultBlog'));
4848                 $this->updateConfig('BaseSkin',                 postVar('BaseSkin'));
4849                 $this->updateConfig('IndexURL',                 postVar('IndexURL'));
4850                 $this->updateConfig('AdminURL',                 postVar('AdminURL'));
4851                 $this->updateConfig('PluginURL',                postVar('PluginURL'));
4852                 $this->updateConfig('SkinsURL',                 postVar('SkinsURL'));
4853                 $this->updateConfig('ActionURL',                postVar('ActionURL'));
4854                 $this->updateConfig('Language',                 postVar('Language'));
4855                 $this->updateConfig('AdminEmail',               postVar('AdminEmail'));
4856                 $this->updateConfig('SessionCookie',    postVar('SessionCookie'));
4857                 $this->updateConfig('AllowMemberCreate',postVar('AllowMemberCreate'));
4858                 $this->updateConfig('AllowMemberMail',  postVar('AllowMemberMail'));
4859                 $this->updateConfig('NonmemberMail',    postVar('NonmemberMail'));
4860                 $this->updateConfig('ProtectMemNames',  postVar('ProtectMemNames'));
4861                 $this->updateConfig('SiteName',                 postVar('SiteName'));
4862                 $this->updateConfig('NewMemberCanLogon',postVar('NewMemberCanLogon'));
4863                 $this->updateConfig('DisableSite',              postVar('DisableSite'));
4864                 $this->updateConfig('DisableSiteURL',   postVar('DisableSiteURL'));
4865                 $this->updateConfig('LastVisit',                postVar('LastVisit'));
4866                 $this->updateConfig('MediaURL',                 postVar('MediaURL'));
4867                 $this->updateConfig('AllowedTypes',             postVar('AllowedTypes'));
4868                 $this->updateConfig('AllowUpload',              postVar('AllowUpload'));
4869                 $this->updateConfig('MaxUploadSize',    postVar('MaxUploadSize'));
4870                 $this->updateConfig('MediaPrefix',              postVar('MediaPrefix'));
4871                 $this->updateConfig('AllowLoginEdit',   postVar('AllowLoginEdit'));
4872                 $this->updateConfig('DisableJsTools',   postVar('DisableJsTools'));
4873                 $this->updateConfig('CookieDomain',             postVar('CookieDomain'));
4874                 $this->updateConfig('CookiePath',               postVar('CookiePath'));
4875                 $this->updateConfig('CookieSecure',             postVar('CookieSecure'));
4876                 $this->updateConfig('URLMode',                  postVar('URLMode'));
4877                 $this->updateConfig('CookiePrefix',             postVar('CookiePrefix'));
4878
4879                 // load new config and redirect (this way, the new language will be used is necessary)
4880                 // note that when changing cookie settings, this redirect might cause the user
4881                 // to have to log in again.
4882                 getConfig();
4883                 redirect($CONF['AdminURL'] . '?action=manage');
4884                 exit;
4885
4886         }
4887
4888         /**
4889          * @todo document this
4890          */
4891         function updateConfig($name, $val) {
4892                 $name = addslashes($name);
4893                 $val = trim(addslashes($val));
4894
4895                 $query = 'UPDATE '.sql_table('config')
4896                            . " SET value='$val'"
4897                            . " WHERE name='$name'";
4898
4899                 sql_query($query) or die("Query error: " . mysql_error());
4900                 return mysql_insert_id();
4901         }
4902
4903         /**
4904          * Error message
4905          * @param string $msg message that will be shown
4906          */
4907         function error($msg) {
4908                 $this->pagehead();
4909                 ?>
4910                 <h2>Error!</h2>
4911                 <?php           echo $msg;
4912                 echo "<br />";
4913                 echo "<a href='index.php' onclick='history.back()'>"._BACK."</a>";
4914                 $this->pagefoot();
4915                 exit;
4916         }
4917
4918         /**
4919          * @todo document this
4920          */
4921         function disallow() {
4922                 ACTIONLOG::add(WARNING, _ACTIONLOG_DISALLOWED . serverVar('REQUEST_URI'));
4923
4924                 $this->error(_ERROR_DISALLOWED);
4925         }
4926
4927         /**
4928          * @todo document this
4929          */
4930         function pagehead($extrahead = '') {
4931                 global $member, $nucleus, $CONF, $manager;
4932
4933                 $manager->notify(
4934                         'AdminPrePageHead',
4935                         array(
4936                                 'extrahead' => &$extrahead,
4937                                 'action' => $this->action
4938                         )
4939                 );
4940
4941                 $baseUrl = htmlspecialchars($CONF['AdminURL']);
4942
4943                 ?>
4944                 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4945                 <html xmlns="http://www.w3.org/1999/xhtml">
4946                 <head>
4947                         <meta http-equiv="Content-Type" content="text/html; charset=<?php echo _CHARSET ?>" />
4948                         <title><?php echo htmlspecialchars($CONF['SiteName'])?> - Admin</title>
4949                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css" href="<?php echo $baseUrl?>styles/admin.css" />
4950                         <link rel="stylesheet" title="Nucleus Admin Default" type="text/css"
4951                         href="<?php echo $baseUrl?>styles/addedit.css" />
4952
4953                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/edit.js"></script>
4954                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/admin.js"></script>
4955                         <script type="text/javascript" src="<?php echo $baseUrl?>javascript/compatibility.js"></script>
4956
4957           <meta http-equiv='Pragma' content='no-cache' />
4958           <meta http-equiv='Cache-Control' content='no-cache, must-revalidate' />
4959           <meta http-equiv='Expires' content='-1' />
4960
4961                         <?php echo $extrahead?>
4962                 </head>
4963                 <body>
4964                 <div class="header">
4965                 <h1><?php echo htmlspecialchars($CONF['SiteName'])?></h1>
4966                 </div>
4967                 <div id="container">
4968                 <div id="content">
4969                 <div class="loginname">
4970                 <?php                   if ($member->isLoggedIn())
4971                                 echo _LOGGEDINAS . ' ' . $member->getDisplayName()
4972                                         ." - <a href='index.php?action=logout'>" . _LOGOUT. "</a>"
4973                                         . "<br /><a href='index.php?action=overview'>" . _ADMINHOME . "</a> - ";
4974                         else
4975                                 echo '<a href="index.php?action=showlogin" title="Log in">' , _NOTLOGGEDIN , '</a> <br />';
4976
4977                         echo "<a href='".$CONF['IndexURL']."'>"._YOURSITE."</a>";
4978
4979                         echo '<br />(';
4980
4981                         if ($member->isLoggedIn() && $member->isAdmin())
4982                                 echo '<a href="http://nucleuscms.org/version.php?v=',getNucleusVersion(),'&amp;pl=',getNucleusPatchLevel(),'" title="Check for upgrade">Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;</a>';
4983                         else
4984                                 echo 'Nucleus CMS ', $nucleus['version'], ' &quot;', $nucleus['codename'], '&quot;';
4985                         echo ')';
4986                 echo '</div>';
4987         }
4988
4989         /**
4990          * @todo document this
4991          */
4992         function pagefoot() {
4993                 global $action, $member, $manager;
4994
4995                 $manager->notify(
4996                         'AdminPrePageFoot',
4997                         array(
4998                                 'action' => $this->action
4999                         )
5000                 );
5001
5002                 if ($member->isLoggedIn() && ($action != 'showlogin')) {
5003                         ?>
5004                         <h2><?php echo  _LOGOUT ?></h2>
5005                         <ul>
5006                                 <li><a href="index.php?action=overview"><?php echo  _BACKHOME?></a></li>
5007                                 <li><a href='index.php?action=logout'><?php echo  _LOGOUT?></a></li>
5008                         </ul>
5009                         <?php           }
5010                 ?>
5011                         <div class="foot">
5012                                 <a href="http://nucleuscms.org/">Nucleus CMS</a> &copy; 2002-2006 The Nucleus Group
5013                                 -
5014                                 <a href="http://nucleuscms.org/donate.php">Donate!</a>
5015                         </div>
5016
5017                         </div><!-- content -->
5018
5019                         <div id="quickmenu">
5020
5021                                 <?php                           // ---- user settings ----
5022                                 if (($action != 'showlogin') && ($member->isLoggedIn())) {
5023                                         echo '<ul>';
5024                                         echo '<li><a href="index.php?action=overview">',_QMENU_HOME,'</a></li>';
5025                                         echo '</ul>';
5026
5027                                         echo '<h2>',_QMENU_ADD,'</h2>';
5028                                         echo '<form method="get" action="index.php"><div>';
5029                                         echo '<input type="hidden" name="action" value="createitem" />';
5030
5031                                                 $showAll = requestVar('showall');
5032                                                 if (($member->isAdmin()) && ($showAll == 'yes')) {
5033                                                         // Super-Admins have access to all blogs! (no add item support though)
5034                                                         $query =  'SELECT bnumber as value, bname as text'
5035                                                                    . ' FROM ' . sql_table('blog')
5036                                                                    . ' ORDER BY bname';
5037                                                 } else {
5038                                                         $query =  'SELECT bnumber as value, bname as text'
5039                                                                    . ' FROM ' . sql_table('blog') . ', ' . sql_table('team')
5040                                                                    . ' WHERE tblog=bnumber and tmember=' . $member->getID()
5041                                                                    . ' ORDER BY bname';
5042                                                 }
5043                                                 $template['name'] = 'blogid';
5044                                                 $template['tabindex'] = 15000;
5045                                                 $template['extra'] = _QMENU_ADD_SELECT;
5046                                                 $template['selected'] = -1;
5047                                                 $template['shorten'] = 10;
5048                                                 $template['shortenel'] = '';
5049                                                 $template['javascript'] = 'onchange="return form.submit()"';
5050                                                 showlist($query,'select',$template);
5051
5052                                         echo '</div></form>';
5053
5054                                         echo '<h2>' . $member->getDisplayName(). '</h2>';
5055                                         echo '<ul>';
5056                                         echo '<li><a href="index.php?action=editmembersettings">',_QMENU_USER_SETTINGS,'</a></li>';
5057                                         echo '<li><a href="index.php?action=browseownitems">',_QMENU_USER_ITEMS,'</a></li>';
5058                                         echo '<li><a href="index.php?action=browseowncomments">',_QMENU_USER_COMMENTS,'</a></li>';
5059                                         echo '</ul>';
5060
5061
5062
5063
5064                                         // ---- general settings ----
5065                                         if ($member->isAdmin()) {
5066
5067                                                 echo '<h2>',_QMENU_MANAGE,'</h2>';
5068
5069                                                 echo '<ul>';
5070                                                 echo '<li><a href="index.php?action=actionlog">',_QMENU_MANAGE_LOG,'</a></li>';
5071                                                 echo '<li><a href="index.php?action=settingsedit">',_QMENU_MANAGE_SETTINGS,'</a></li>';
5072                                                 echo '<li><a href="index.php?action=usermanagement">',_QMENU_MANAGE_MEMBERS,'</a></li>';
5073                                                 echo '<li><a href="index.php?action=createnewlog">',_QMENU_MANAGE_NEWBLOG,'</a></li>';
5074                                                 echo '<li><a href="index.php?action=backupoverview">',_QMENU_MANAGE_BACKUPS,'</a></li>';
5075                                                 echo '<li><a href="index.php?action=pluginlist">',_QMENU_MANAGE_PLUGINS,'</a></li>';
5076                                                 echo '</ul>';
5077
5078                                                 echo '<h2>',_QMENU_LAYOUT,'</h2>';
5079                                                 echo '<ul>';
5080                                                 echo '<li><a href="index.php?action=skinoverview">',_QMENU_LAYOUT_SKINS,'</a></li>';
5081                                                 echo '<li><a href="index.php?action=templateoverview">',_QMENU_LAYOUT_TEMPL,'</a></li>';
5082                                                 echo '<li><a href="index.php?action=skinieoverview">',_QMENU_LAYOUT_IEXPORT,'</a></li>';
5083                                                 echo '</ul>';
5084
5085                                         }
5086
5087                                         $aPluginExtras = array();
5088                                         $manager->notify(
5089                                                 'QuickMenu',
5090                                                 array(
5091                                                         'options' => &$aPluginExtras
5092                                                 )
5093                                         );
5094                                         if (count($aPluginExtras) > 0)
5095                                         {
5096                                                 echo '<h2>', _QMENU_PLUGINS, '</h2>';
5097                                                 echo '<ul>';
5098                                                 foreach ($aPluginExtras as $aInfo)
5099                                                 {
5100                                                         echo '<li><a href="'.htmlspecialchars($aInfo['url']).'" title="'.htmlspecialchars($aInfo['tooltip']).'">'.htmlspecialchars($aInfo['title']).'</a></li>';
5101                                                 }
5102                                                 echo '</ul>';
5103                                         }
5104
5105                                 } else if (($action == 'activate') || ($action == 'activatesetpwd')) {
5106
5107                                         echo '<h2>', _QMENU_ACTIVATE, '</h2>', _QMENU_ACTIVATE_TEXT;
5108                                 } else {
5109                                         // introduction text on login screen
5110                                         echo '<h2>', _QMENU_INTRO, '</h2>', _QMENU_INTRO_TEXT;
5111                                 }
5112                                 ?>
5113                         </div>
5114
5115                         <!-- content / quickmenu container -->
5116                         </div>
5117
5118
5119                         </body>
5120                         </html>
5121                 <?php   }
5122
5123         /**
5124          * @todo document this
5125          */
5126         function action_regfile() {
5127                 global $member, $CONF;
5128
5129                 $blogid = intRequestVar('blogid');
5130
5131                 $member->teamRights($blogid) or $this->disallow();
5132
5133                 // header-code stolen from phpMyAdmin
5134                 // REGEDIT and bookmarklet code stolen from GreyMatter
5135
5136                 header('Content-Type: application/octetstream');
5137                 header('Content-Disposition: filename="nucleus.reg"');
5138                 header('Pragma: no-cache');
5139                 header('Expires: 0');
5140
5141                 echo "REGEDIT4\n";
5142                 echo "[HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\MenuExt\\Post To &Nucleus (".getBlogNameFromID($blogid).")]\n";
5143                 echo '@="' . $CONF['AdminURL'] . "bookmarklet.php?action=contextmenucode&blogid=".intval($blogid)."\"\n";
5144                 echo '"contexts"=hex:31';
5145         }
5146
5147         /**
5148          * @todo document this
5149          */
5150         function action_bookmarklet() {
5151                 global $member, $manager;
5152
5153                 $blogid = intRequestVar('blogid');
5154
5155                 $member->teamRights($blogid) or $this->disallow();
5156
5157                 $blog =& $manager->getBlog($blogid);
5158                 $bm = getBookmarklet($blogid);
5159
5160                 $this->pagehead();
5161
5162                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5163
5164                 ?>
5165
5166                 <h2>Bookmarklet<!-- and Right Click Menu --></h2>
5167
5168                 <p>
5169                 Bookmarklet とは、クリック1回で記事の投稿ができるシステムです。 この Bookmarklet をインストールすると、ブラウザのツールバーの'add to weblog'ボタンが利用可能となり、Nucleusの新規アイテムの追加ウィンドウがポップアップします。任意のWebページを開いた状態でこのボタンを押せば、そのWebページのタイトルと、そのページへのリンクタグがすでに埋め込まれた状態でアイテム追加ウィンドウが開き、さらに、そのページ内に引用したい文を選択した状態であればその引用文も自動的に引用します。
5170                 </p>
5171
5172                 <h3>Bookmarklet</h3>
5173                 <p>
5174                         下のリンク部分を「お気に入り」もしくはツールバーにドラッグできます。<small>(その前にテストしてみたい場合は単純に下のリンクをクリックしてみてください)</small>
5175                         <br />
5176                         <br />
5177                         <a href="<?php echo htmlspecialchars($bm)?>">Add to <?php echo $blog->getShortName()?></a> (ほとんどのブラウザで動作します)
5178                 </p>
5179
5180                 <h3>右クリックメニューにインストール (WindowsでIE使用時)</h3>
5181                 <p>
5182                         <?php
5183                                 $url = 'index.php?action=regfile&blogid=' . intval($blogid);
5184                                 $url = $manager->addTicketToUrl($url);
5185                         ?>
5186                         あるいは<a href="<?php echo htmlspecialchars($url) ?>">右クリックメニュー</a>にインストールすることもできます (「開く」を選択すれば直接レジストリに登録します)
5187                 </p>
5188
5189                 <p>
5190                         このインストールした右クリックメニューを表示するためにはIEの再起動が必要です。
5191                 </p>
5192
5193                 <h3>アンインストール</h3>
5194                 <p>
5195                         「お気に入り」もしくはツールバーから消すには、単に削除するだけです。
5196                 </p>
5197
5198                 <p>
5199                         右クリックメニューから消したい時は、以下の手順を踏んでください:
5200                 </p>
5201
5202                 <ol>
5203                         <li>スタートメニューから「ファイルを指定して実行...」を選択</li>
5204                         <li>"regedit" と入力</li>
5205                         <li>"OK" ボタンを押す</li>
5206                         <li>"\HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt" をツリーの中から検索</li>
5207                         <li>"add to weblog" エントリを削除</li>
5208                 </ol>
5209
5210                 <?php
5211                 $this->pagefoot();
5212
5213         }
5214
5215         /**
5216          * @todo document this
5217          */
5218         function action_actionlog() {
5219                 global $member, $manager;
5220
5221                 $member->isAdmin() or $this->disallow();
5222
5223                 $this->pagehead();
5224
5225                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5226
5227                 $url = $manager->addTicketToUrl('index.php?action=clearactionlog');
5228
5229                 ?>
5230                         <h2><?php echo _ACTIONLOG_CLEAR_TITLE?></h2>
5231                         <p><a href="<?php echo htmlspecialchars($url)?>"><?php echo _ACTIONLOG_CLEAR_TEXT?></a></p>
5232                 <?php
5233                 echo '<h2>' . _ACTIONLOG_TITLE . '</h2>';
5234
5235                 $query =  'SELECT * FROM '.sql_table('actionlog').' ORDER BY timestamp DESC';
5236                 $template['content'] = 'actionlist';
5237                 $amount = showlist($query,'table',$template);
5238
5239                 $this->pagefoot();
5240
5241         }
5242
5243         /**
5244          * @todo document this
5245          */
5246         function action_banlist() {
5247                 global $member, $manager;
5248
5249                 $blogid = intRequestVar('blogid');
5250
5251                 $member->blogAdminRights($blogid) or $this->disallow();
5252
5253                 $blog =& $manager->getBlog($blogid);
5254
5255                 $this->pagehead();
5256
5257                 echo '<p><a href="index.php?action=overview">(',_BACKHOME,')</a></p>';
5258
5259                 echo '<h2>' . _BAN_TITLE . " '". $this->bloglink($blog) ."'</h2>";
5260
5261                 $query =  'SELECT * FROM '.sql_table('ban').' WHERE blogid='.$blogid.' ORDER BY iprange';
5262                 $template['content'] = 'banlist';
5263                 $amount = showlist($query,'table',$template);
5264
5265                 if ($amount == 0)
5266                         echo _BAN_NONE;
5267
5268                 echo '<h2>'._BAN_NEW_TITLE.'</h2>';
5269                 echo "<p><a href='index.php?action=banlistnew&amp;blogid=$blogid'>"._BAN_NEW_TEXT."</a></p>";
5270
5271
5272                 $this->pagefoot();
5273
5274         }
5275
5276         /**
5277          * @todo document this
5278          */
5279         function action_banlistdelete() {
5280                 global $member, $manager;
5281
5282                 $blogid = intRequestVar('blogid');
5283                 $iprange = requestVar('iprange');
5284
5285                 $member->blogAdminRights($blogid) or $this->disallow();
5286
5287                 $blog =& $manager->getBlog($blogid);
5288
5289                 $this->pagehead();
5290                 ?>
5291                         <h2><?php echo _BAN_REMOVE_TITLE?></h2>
5292
5293                         <form method="post" action="index.php">
5294
5295                         <h3><?php echo _BAN_IPRANGE?></h3>
5296
5297                         <p>
5298                                 <?php echo _CONFIRMTXT_BAN?> <?php echo htmlspecialchars($iprange) ?>
5299                                 <input name="iprange" type="hidden" value="<?php echo htmlspecialchars($iprange)?>" />
5300                         </p>
5301
5302                         <h3><?php echo _BAN_BLOGS?></h3>
5303
5304                         <div>
5305                                 <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5306                                 <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">Only blog '<?php echo htmlspecialchars($blog->getName())?>'</label>
5307                                 <br />
5308                                 <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5309                         </div>
5310
5311                         <h3><?php echo _BAN_DELETE_TITLE?></h3>
5312
5313                         <div>
5314                                 <?php $manager->addTicketHidden() ?>
5315                                 <input type="hidden" name="action" value="banlistdeleteconfirm" />
5316                                 <input type="submit" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5317                         </div>
5318
5319                         </form>
5320                 <?php
5321                 $this->pagefoot();
5322         }
5323
5324         /**
5325          * @todo document this
5326          */
5327         function action_banlistdeleteconfirm() {
5328                 global $member, $manager;
5329
5330                 $blogid = intPostVar('blogid');
5331                 $allblogs = postVar('allblogs');
5332                 $iprange = postVar('iprange');
5333
5334                 $member->blogAdminRights($blogid) or $this->disallow();
5335
5336                 $deleted = array();
5337
5338                 if (!$allblogs) {
5339                         if (BAN::removeBan($blogid, $iprange))
5340                                 array_push($deleted, $blogid);
5341                 } else {
5342                         // get blogs fot which member has admin rights
5343                         $adminblogs = $member->getAdminBlogs();
5344                         foreach ($adminblogs as $blogje) {
5345                                 if (BAN::removeBan($blogje, $iprange))
5346                                         array_push($deleted, $blogje);
5347                         }
5348                 }
5349
5350                 if (sizeof($deleted) == 0)
5351                         $this->error(_ERROR_DELETEBAN);
5352
5353                 $this->pagehead();
5354
5355                 echo '<a href="index.php?action=banlist&amp;blogid=',$blogid,'">(',_BACK,')</a>';
5356                 echo '<h2>'._BAN_REMOVED_TITLE.'</h2>';
5357                 echo "<p>"._BAN_REMOVED_TEXT."</p>";
5358
5359                 echo "<ul>";
5360                 foreach ($deleted as $delblog) {
5361                         $b =& $manager->getBlog($delblog);
5362                         echo "<li>" . htmlspecialchars($b->getName()). "</li>";
5363                 }
5364                 echo "</ul>";
5365
5366                 $this->pagefoot();
5367
5368         }
5369
5370         /**
5371          * @todo document this
5372          */
5373         function action_banlistnewfromitem() {
5374                 $this->action_banlistnew(getBlogIDFromItemID(intRequestVar('itemid')));
5375         }
5376
5377         /**
5378          * @todo document this
5379          */
5380         function action_banlistnew($blogid = '') {
5381                 global $member, $manager;
5382
5383                 if ($blogid == '')
5384                         $blogid = intRequestVar('blogid');
5385
5386                 $ip = requestVar('ip');
5387
5388                 $member->blogAdminRights($blogid) or $this->disallow();
5389
5390                 $blog =& $manager->getBlog($blogid);
5391
5392                 $this->pagehead();
5393                 ?>
5394                 <h2><?php echo _BAN_ADD_TITLE?></h2>
5395
5396
5397                 <form method="post" action="index.php">
5398
5399                 <h3><?php echo _BAN_IPRANGE?></h3>
5400
5401                 <p><?php echo _BAN_IPRANGE_TEXT?></p>
5402
5403                 <div class="note">
5404                 <b>An example</b>: "134.58.253.193" will only block one computer, while "134.58.253" will block 256 IP addresses, including the one from the first example.
5405                 </div>
5406
5407                 <div>
5408                 <?php                   if ($ip) {
5409                 ?>
5410                         <input name="iprange" type="radio" value="<?php echo htmlspecialchars($ip)?>" checked="checked" id="ip_fixed" /><label for="ip_fixed"><?php echo htmlspecialchars($ip)?></label>
5411                         <br />
5412                         <input name="iprange" type="radio" value="custom" id="ip_custom" /><label for="ip_custom">Custom: </label><input name='customiprange' value='<?php echo htmlspecialchars($ip)?>' maxlength='15' size='15' />
5413                 <?php   } else {
5414                                 echo "<input name='iprange' value='custom' type='hidden' />";
5415                                 echo "<input name='customiprange' value='' maxlength='15' size='15' />";
5416                         }
5417                 ?>
5418                 </div>
5419
5420                 <h3><?php echo _BAN_BLOGS?></h3>
5421
5422                 <p><?php echo _BAN_BLOGS_TEXT?></p>
5423
5424                 <div>
5425                         <input type="hidden" name="blogid" value="<?php echo $blogid?>" />
5426                         <input name="allblogs" type="radio" value="0" id="allblogs_one" /><label for="allblogs_one">'<?php echo htmlspecialchars($blog->getName())?>'</label>
5427                         <br />
5428                         <input name="allblogs" type="radio" value="1" checked="checked" id="allblogs_all" /><label for="allblogs_all"><?php echo _BAN_ALLBLOGS?></label>
5429                 </div>
5430
5431                 <h3><?php echo _BAN_REASON_TITLE?></h3>
5432
5433                 <p><?php echo _BAN_REASON_TEXT?></p>
5434
5435                 <div><textarea name="reason" cols="40" rows="5"></textarea></div>
5436
5437                 <h3><?php echo _BAN_ADD_TITLE?></h3>
5438
5439                 <div>
5440                         <input name="action" type="hidden" value="banlistadd" />
5441                         <?php $manager->addTicketHidden() ?>
5442                         <input type="submit" value="<?php echo _BAN_ADD_BTN?>" />
5443                 </div>
5444
5445                 </form>
5446
5447                 <?php           $this->pagefoot();
5448         }
5449
5450         /**
5451          * @todo document this
5452          */
5453         function action_banlistadd() {
5454                 global $member;
5455
5456                 $blogid =               intPostVar('blogid');
5457                 $allblogs =     postVar('allblogs');
5458                 $iprange =              postVar('iprange');
5459                 if ($iprange == "custom")
5460                         $iprange = postVar('customiprange');
5461                 $reason =               postVar('reason');
5462
5463                 $member->blogAdminRights($blogid) or $this->disallow();
5464
5465                 // TODO: check IP range validity
5466
5467                 if (!$allblogs) {
5468                         if (!BAN::addBan($blogid, $iprange, $reason))
5469                                 $this->error(_ERROR_ADDBAN);
5470                 } else {
5471                         // get blogs fot which member has admin rights
5472                         $adminblogs = $member->getAdminBlogs();
5473                         $failed = 0;
5474                         foreach ($adminblogs as $blogje) {
5475                                 if (!BAN::addBan($blogje, $iprange, $reason))
5476                                         $failed = 1;
5477                         }
5478                         if ($failed)
5479                                 $this->error(_ERROR_ADDBAN);
5480                 }
5481
5482                 $this->action_banlist();
5483
5484         }
5485
5486         /**
5487          * @todo document this
5488          */
5489         function action_clearactionlog() {
5490                 global $member;
5491
5492                 $member->isAdmin() or $this->disallow();
5493
5494                 ACTIONLOG::clear();
5495
5496                 $this->action_manage(_MSG_ACTIONLOGCLEARED);
5497         }
5498
5499         /**
5500          * @todo document this
5501          */
5502         function action_backupoverview() {
5503                 global $member, $manager;
5504
5505                 $member->isAdmin() or $this->disallow();
5506
5507                 $this->pagehead();
5508
5509                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5510                 ?>
5511                 <h2><?php echo _BACKUPS_TITLE?></h2>
5512
5513                 <h3><?php echo _BACKUP_TITLE?></h3>
5514
5515                 <p><?php echo _BACKUP_INTRO?></p>
5516
5517                 <form method="post" action="index.php"><p>
5518                 <input type="hidden" name="action" value="backupcreate" />
5519                 <?php $manager->addTicketHidden() ?>
5520
5521                 <input type="radio" name="gzip" value="1" checked="checked" id="gzip_yes" tabindex="10" /><label for="gzip_yes"><?php echo _BACKUP_ZIP_YES?></label>
5522                 <br />
5523                 <input type="radio" name="gzip" value="0" id="gzip_no" tabindex="10" /><label for="gzip_no" ><?php echo _BACKUP_ZIP_NO?></label>
5524                 <br /><br />
5525                 <input type="submit" value="<?php echo _BACKUP_BTN?>" tabindex="20" />
5526
5527                 </p></form>
5528
5529                 <div class="note"><?php echo _BACKUP_NOTE?></div>
5530
5531
5532                 <h3><?php echo _RESTORE_TITLE?></h3>
5533
5534                 <div class="note"><?php echo _RESTORE_NOTE?></div>
5535
5536                 <p><?php echo _RESTORE_INTRO?></p>
5537
5538                 <form method="post" action="index.php" enctype="multipart/form-data"><p>
5539                         <input type="hidden" name="action" value="backuprestore" />
5540                         <?php $manager->addTicketHidden() ?>
5541                         <input name="backup_file" type="file" tabindex="30" />
5542                         <br /><br />
5543                         <input type="submit" value="<?php echo _RESTORE_BTN?>" tabindex="40" />
5544                         <br /><input type="checkbox" name="letsgo" value="1" id="letsgo" tabindex="50" /><label for="letsgo"><?php echo _RESTORE_IMSURE?></label>
5545                         <br /><?php echo _RESTORE_WARNING?>
5546                 </p></form>
5547
5548                 <?php           $this->pagefoot();
5549         }
5550
5551         /**
5552          * @todo document this
5553          */
5554         function action_backupcreate() {
5555                 global $member, $DIR_LIBS;
5556
5557                 $member->isAdmin() or $this->disallow();
5558
5559                 // use compression ?
5560                 $useGzip = intval(postVar('gzip'));
5561
5562                 include($DIR_LIBS . 'backup.php');
5563
5564                 // try to extend time limit
5565                 // (creating/restoring dumps might take a while)
5566                 @set_time_limit(1200);
5567
5568                 do_backup($useGzip);
5569                 exit;
5570         }
5571
5572         /**
5573          * @todo document this
5574          */
5575         function action_backuprestore() {
5576                 global $member, $DIR_LIBS;
5577
5578                 $member->isAdmin() or $this->disallow();
5579
5580                 if (intPostVar('letsgo') != 1)
5581                         $this->error(_ERROR_BACKUP_NOTSURE);
5582
5583                 include($DIR_LIBS . 'backup.php');
5584
5585                 // try to extend time limit
5586                 // (creating/restoring dumps might take a while)
5587                 @set_time_limit(1200);
5588
5589                 $message = do_restore();
5590                 if ($message != '')
5591                         $this->error($message);
5592
5593                 $this->pagehead();
5594                 ?>
5595                 <h2><?php echo _RESTORE_COMPLETE?></h2>
5596                 <?php           $this->pagefoot();
5597
5598         }
5599
5600         /**
5601          * @todo document this
5602          */
5603         function action_pluginlist() {
5604                 global $member, $manager;
5605
5606                 // check if allowed
5607                 $member->isAdmin() or $this->disallow();
5608
5609                 $this->pagehead();
5610
5611                 echo '<p><a href="index.php?action=manage">(',_BACKTOMANAGE,')</a></p>';
5612
5613                 echo '<h2>' , _PLUGS_TITLE_MANAGE , ' ', help('plugins'), '</h2>';
5614
5615                 echo '<h3>' , _PLUGS_TITLE_INSTALLED , '</h3>';
5616
5617
5618                 $query =  'SELECT * FROM '.sql_table('plugin').' ORDER BY porder ASC';
5619
5620                 $template['content'] = 'pluginlist';
5621                 $template['tabindex'] = 10;
5622                 showlist($query, 'table', $template);
5623
5624                 ?>
5625                         <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
5626
5627                         <p><?php echo _PLUGS_TEXT_UPDATE?></p>
5628
5629                         <form method="post" action="index.php"><div>
5630                                 <input type="hidden" name="action" value="pluginupdate" />
5631                                 <?php $manager->addTicketHidden() ?>
5632                                 <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
5633                         </div></form>
5634
5635                         <h3><?php echo _PLUGS_TITLE_NEW?></h3>
5636
5637                         <?php                           // find a list of possibly non-installed plugins
5638                                 $candidates = array();
5639                                 global $DIR_PLUGINS;
5640                                 $dirhandle = opendir($DIR_PLUGINS);
5641                                 while ($filename = readdir($dirhandle)) {
5642                                         if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
5643                                                 $name = $matches[1];
5644                                                 // only show in list when not yet installed
5645                                                 $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
5646                                                 if (mysql_num_rows($res) == 0)
5647                                                         array_push($candidates,$name);
5648                                         }
5649                                 }
5650                                 closedir($dirhandle);
5651
5652                                 if (sizeof($candidates) > 0) {
5653                         ?>
5654
5655                         <p><?php echo _PLUGS_ADD_TEXT?></p>
5656
5657
5658                         <form method='post' action='index.php'><div>
5659                                 <input type='hidden' name='action' value='pluginadd' />
5660                                 <?php $manager->addTicketHidden() ?>
5661                                 <select name="filename" tabindex="30">
5662                                 <?php                                   foreach($candidates as $name)
5663                                                 echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
5664                                 ?>
5665                                 </select>
5666                                 <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
5667                         </div></form>
5668
5669                 <?php                   } else {        // sizeof(candidates) == 0
5670                                 echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
5671                         }
5672
5673                 $this->pagefoot();
5674         }
5675
5676         /**
5677          * @todo document this
5678          */
5679         function action_pluginhelp() {
5680                 global $member, $manager, $DIR_PLUGINS, $CONF;
5681
5682                 // check if allowed
5683                 $member->isAdmin() or $this->disallow();
5684
5685                 $plugid = intGetVar('plugid');
5686
5687                 if (!$manager->pidInstalled($plugid))
5688                         $this->error(_ERROR_NOSUCHPLUGIN);
5689
5690                 $plugName = getPluginNameFromPid($plugid);
5691
5692                 $this->pagehead();
5693
5694                 echo '<p><a href="index.php?action=pluginlist">(',_PLUGS_BACK,')</a></p>';
5695
5696                 echo '<h2>',_PLUGS_HELP_TITLE,': ',htmlspecialchars($plugName),'</h2>';
5697
5698                 $plug =& $manager->getPlugin($plugName);
5699                 $helpFile = $DIR_PLUGINS.$plug->getShortName().'/help.html';
5700
5701                 if (($plug->supportsFeature('HelpPage') > 0) && (@file_exists($helpFile))) {
5702                         @readfile($helpFile);
5703                 } else {
5704                         echo '<p>Error: ', _ERROR_PLUGNOHELPFILE,'</p>';
5705                         echo '<p><a href="index.php?action=pluginlist">(',_BACK,')</a></p>';
5706                 }
5707
5708
5709                 $this->pagefoot();
5710         }
5711
5712         /**
5713          * @todo document this
5714          */
5715         function action_pluginadd() {
5716                 global $member, $manager, $DIR_PLUGINS;
5717
5718                 // check if allowed
5719                 $member->isAdmin() or $this->disallow();
5720
5721                 $name = postVar('filename');
5722
5723                 if ($manager->pluginInstalled($name))
5724                         $this->error(_ERROR_DUPPLUGIN);
5725                 if (!checkPlugin($name))
5726                         $this->error(_ERROR_PLUGFILEERROR . ' (' . $name . ')');
5727
5728                 // get number of currently installed plugins
5729                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
5730                 $numCurrent = mysql_num_rows($res);
5731
5732                 // plugin will be added as last one in the list
5733                 $newOrder = $numCurrent + 1;
5734
5735                 $manager->notify(
5736                         'PreAddPlugin',
5737                         array(
5738                                 'file' => &$name
5739                         )
5740                 );
5741
5742                 // do this before calling getPlugin (in case the plugin id is used there)
5743                 $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
5744                 sql_query($query);
5745                 $iPid = mysql_insert_id();
5746
5747                 $manager->clearCachedInfo('installedPlugins');
5748
5749                 // Load the plugin for condition checking and instalation
5750                 $plugin =& $manager->getPlugin($name);
5751
5752                 // check if it got loaded (could have failed)
5753                 if (!$plugin)
5754                 {
5755                         sql_query('DELETE FROM ' . sql_table('plugin') . ' WHERE pid='. intval($iPid));
5756                         $manager->clearCachedInfo('installedPlugins');
5757                         $this->error(_ERROR_PLUGIN_LOAD);
5758                 }
5759
5760                 // check if plugin needs a newer Nucleus version
5761                 if (getNucleusVersion() < $plugin->getMinNucleusVersion())
5762                 {
5763                         // uninstall plugin again...
5764                         $this->deleteOnePlugin($plugin->getID());
5765
5766                         // ...and show error
5767                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion());
5768                 }
5769
5770                 // check if plugin needs a newer Nucleus version
5771                 if ((getNucleusVersion() == $plugin->getMinNucleusVersion()) && (getNucleusPatchLevel() < $plugin->getMinNucleusPatchLevel()))
5772                 {
5773                         // uninstall plugin again...
5774                         $this->deleteOnePlugin($plugin->getID());
5775
5776                         // ...and show error
5777                         $this->error(_ERROR_NUCLEUSVERSIONREQ . $plugin->getMinNucleusVersion() . ' patch ' . $plugin->getMinNucleusPatchLevel());
5778                 }
5779
5780                 $pluginList = $plugin->getPluginDep();
5781                 foreach ($pluginList as $pluginName)
5782                 {
5783
5784                         $res = sql_query('SELECT * FROM '.sql_table('plugin') . ' WHERE pfile="' . $pluginName . '"');
5785                         if (mysql_num_rows($res) == 0)
5786                         {
5787                                 // uninstall plugin again...
5788                                 $this->deleteOnePlugin($plugin->getID());
5789
5790                                 $this->error(_ERROR_INSREQPLUGIN . $pluginName);
5791                         }
5792                 }
5793
5794                 // call the install method of the plugin
5795                 $plugin->install();
5796
5797                 $manager->notify(
5798                         'PostAddPlugin',
5799                         array(
5800                                 'plugin' => &$plugin
5801                         )
5802                 );
5803
5804                 // update all events
5805                 $this->action_pluginupdate();
5806         }
5807
5808         /**
5809          * @todo document this
5810          */
5811         function action_pluginupdate() {
5812                 global $member, $manager;
5813
5814                 // check if allowed
5815                 $member->isAdmin() or $this->disallow();
5816
5817                 // delete everything from plugin_events
5818                 sql_query('DELETE FROM '.sql_table('plugin_event'));
5819
5820                 // loop over all installed plugins
5821                 $res = sql_query('SELECT pid, pfile FROM '.sql_table('plugin'));
5822                 while($o = mysql_fetch_object($res)) {
5823                         $pid = $o->pid;
5824                         $plug =& $manager->getPlugin($o->pfile);
5825                         if ($plug)
5826                         {
5827                                 $eventList = $plug->getEventList();
5828                                 foreach ($eventList as $eventName)
5829                                         sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
5830                         }
5831                 }
5832
5833                 $this->action_pluginlist();
5834         }
5835
5836         /**
5837          * @todo document this
5838          */
5839         function action_plugindelete() {
5840                 global $member, $manager;
5841
5842                 // check if allowed
5843                 $member->isAdmin() or $this->disallow();
5844
5845                 $pid = intGetVar('plugid');
5846
5847                 if (!$manager->pidInstalled($pid))
5848                         $this->error(_ERROR_NOSUCHPLUGIN);
5849
5850                 $this->pagehead();
5851                 ?>
5852                         <h2><?php echo _DELETE_CONFIRM?></h2>
5853
5854                         <p><?php echo _CONFIRMTXT_PLUGIN?> <strong><?php echo getPluginNameFromPid($pid)?></strong>?</p>
5855
5856                         <form method="post" action="index.php"><div>
5857                         <?php $manager->addTicketHidden() ?>
5858                         <input type="hidden" name="action" value="plugindeleteconfirm" />
5859                         <input type="hidden" name="plugid" value="<?php echo $pid; ?>" />
5860                         <input type="submit" tabindex="10" value="<?php echo _DELETE_CONFIRM_BTN?>" />
5861                         </div></form>
5862                 <?php           $this->pagefoot();
5863         }
5864
5865         /**
5866          * @todo document this
5867          */
5868         function action_plugindeleteconfirm() {
5869                 global $member, $manager;
5870
5871                 // check if allowed
5872                 $member->isAdmin() or $this->disallow();
5873
5874                 $pid = intPostVar('plugid');
5875
5876                 $error = $this->deleteOnePlugin($pid, 1);
5877                 if ($error) {
5878                         $this->error($error);
5879                 }
5880
5881                 $this->action_pluginlist();
5882         }
5883
5884         /**
5885          * @todo document this
5886          */
5887         function deleteOnePlugin($pid, $callUninstall = 0) {
5888                 global $manager;
5889
5890                 $pid = intval($pid);
5891
5892                 if (!$manager->pidInstalled($pid))
5893                         return _ERROR_NOSUCHPLUGIN;
5894
5895                 $name = quickQuery('SELECT pfile as result FROM '.sql_table('plugin').' WHERE pid='.$pid);
5896
5897                 // call the unInstall method of the plugin
5898                 if ($callUninstall) {
5899                         $plugin =& $manager->getPlugin($name);
5900                         if ($plugin) $plugin->unInstall();
5901                 }
5902
5903                 // check dependency before delete
5904                 $res = sql_query('SELECT pfile FROM '.sql_table('plugin'));
5905                 while($o = mysql_fetch_object($res)) {
5906                         $plug =& $manager->getPlugin($o->pfile);
5907                         if ($plug)
5908                         {
5909                                 $depList = $plug->getPluginDep();
5910                                 foreach ($depList as $depName)
5911                                 {
5912                                         if ($name == $depName)
5913                                         {
5914                                                 return _ERROR_DELREQPLUGIN . $o->pfile;
5915                                         }
5916                                 }
5917                         }
5918                 }
5919
5920                 $manager->notify('PreDeletePlugin', array('plugid' => $pid));
5921
5922                 // delete all subscriptions
5923                 sql_query('DELETE FROM '.sql_table('plugin_event').' WHERE pid=' . $pid);
5924
5925                 // delete all options
5926                 // get OIDs from plugin_option_desc
5927                 $res = sql_query('SELECT oid FROM ' . sql_table('plugin_option_desc') . ' WHERE opid=' . $pid);
5928                 $aOIDs = array();
5929                 while ($o = mysql_fetch_object($res)) {
5930                         array_push($aOIDs, $o->oid);
5931                 }
5932
5933                 // delete from plugin_option and plugin_option_desc
5934                 sql_query('DELETE FROM '.sql_table('plugin_option_desc').' WHERE opid=' . $pid);
5935                 if (count($aOIDs) > 0)
5936                         sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid in ('.implode(',',$aOIDs).')');
5937
5938                 // update order numbers
5939                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid=' . $pid);
5940                 $o = mysql_fetch_object($res);
5941                 sql_query('UPDATE '.sql_table('plugin').' SET porder=(porder - 1) WHERE porder>'.$o->porder);
5942
5943                 // delete row
5944                 sql_query('DELETE FROM '.sql_table('plugin').' WHERE pid='.$pid);
5945
5946                 $manager->clearCachedInfo('installedPlugins');
5947                 $manager->notify('PostDeletePlugin', array('plugid' => $pid));
5948
5949                 return '';
5950         }
5951
5952         /**
5953          * @todo document this
5954          */
5955         function action_pluginup() {
5956                 global $member, $manager;
5957
5958                 // check if allowed
5959                 $member->isAdmin() or $this->disallow();
5960
5961                 $plugid = intGetVar('plugid');
5962
5963                 if (!$manager->pidInstalled($plugid))
5964                         $this->error(_ERROR_NOSUCHPLUGIN);
5965
5966                 // 1. get old order number
5967                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
5968                 $o = mysql_fetch_object($res);
5969                 $oldOrder = $o->porder;
5970
5971                 // 2. calculate new order number
5972                 $newOrder = ($oldOrder > 1) ? ($oldOrder - 1) : 1;
5973
5974                 // 3. update plug numbers
5975                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
5976                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
5977
5978                 $this->action_pluginlist();
5979         }
5980
5981         /**
5982          * @todo document this
5983          */
5984         function action_plugindown() {
5985                 global $member, $manager;
5986
5987                 // check if allowed
5988                 $member->isAdmin() or $this->disallow();
5989
5990                 $plugid = intGetVar('plugid');
5991                 if (!$manager->pidInstalled($plugid))
5992                         $this->error(_ERROR_NOSUCHPLUGIN);
5993
5994                 // 1. get old order number
5995                 $res = sql_query('SELECT porder FROM '.sql_table('plugin').' WHERE pid='.$plugid);
5996                 $o = mysql_fetch_object($res);
5997                 $oldOrder = $o->porder;
5998
5999                 $res = sql_query('SELECT * FROM '.sql_table('plugin'));
6000                 $maxOrder = mysql_num_rows($res);
6001
6002                 // 2. calculate new order number
6003                 $newOrder = ($oldOrder < $maxOrder) ? ($oldOrder + 1) : $maxOrder;
6004
6005                 // 3. update plug numbers
6006                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$oldOrder.' WHERE porder='.$newOrder);
6007                 sql_query('UPDATE '.sql_table('plugin').' SET porder='.$newOrder.' WHERE pid='.$plugid);
6008
6009                 $this->action_pluginlist();
6010         }
6011
6012         /**
6013          * @todo document this
6014          */
6015         function action_pluginoptions($message = '') {
6016                 global $member, $manager;
6017
6018                 // check if allowed
6019                 $member->isAdmin() or $this->disallow();
6020
6021                 $pid = intRequestVar('plugid');
6022                 if (!$manager->pidInstalled($pid))
6023                         $this->error(_ERROR_NOSUCHPLUGIN);
6024
6025                 $extrahead = '<script type="text/javascript" src="javascript/numbercheck.js"></script>';
6026                 $this->pagehead($extrahead);
6027
6028                 ?>
6029                         <p><a href="index.php?action=pluginlist">(<?php echo _PLUGS_BACK?>)</a></p>
6030
6031                         <h2>Options for <?php echo htmlspecialchars(getPluginNameFromPid($pid))?></h2>
6032
6033                         <?php if  ($message) echo $message?>
6034
6035                         <form action="index.php" method="post">
6036                         <div>
6037                                 <input type="hidden" name="action" value="pluginoptionsupdate" />
6038                                 <input type="hidden" name="plugid" value="<?php echo $pid?>" />
6039
6040                 <?php
6041
6042                 $manager->addTicketHidden();
6043
6044                 $aOptions = array();
6045                 $aOIDs = array();
6046                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ' WHERE ocontext=\'global\' and opid=' . $pid . ' ORDER BY oid ASC';
6047                 $r = sql_query($query);
6048                 while ($o = mysql_fetch_object($r)) {
6049                         array_push($aOIDs, $o->oid);
6050                         $aOptions[$o->oid] = array(
6051                                                 'oid' => $o->oid,
6052                                                 'value' => $o->odef,
6053                                                 'name' => $o->oname,
6054                                                 'description' => $o->odesc,
6055                                                 'type' => $o->otype,
6056                                                 'typeinfo' => $o->oextra,
6057                                                 'contextid' => 0
6058                         );
6059                 }
6060                 // fill out actual values
6061                 if (count($aOIDs) > 0) {
6062                         $r = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE oid in ('.implode(',',$aOIDs).')');
6063                         while ($o = mysql_fetch_object($r))
6064                                 $aOptions[$o->oid]['value'] = $o->ovalue;
6065                 }
6066
6067                 // call plugins
6068                 $manager->notify('PrePluginOptionsEdit',array('context' => 'global', 'plugid' => $pid, 'options'=>&$aOptions));
6069
6070                 $template['content'] = 'plugoptionlist';
6071                 $amount = showlist($aOptions,'table',$template);
6072                 if ($amount == 0)
6073                         echo '<p>',_ERROR_NOPLUGOPTIONS,'</p>';
6074
6075                 ?>
6076                         </div>
6077                         </form>
6078                 <?php           $this->pagefoot();
6079
6080
6081
6082         }
6083
6084         /**
6085          * @todo document this
6086          */
6087         function action_pluginoptionsupdate() {
6088                 global $member, $manager;
6089
6090                 // check if allowed
6091                 $member->isAdmin() or $this->disallow();
6092
6093                 $pid = intRequestVar('plugid');
6094                 if (!$manager->pidInstalled($pid))
6095                         $this->error(_ERROR_NOSUCHPLUGIN);
6096
6097                 $aOptions = requestArray('plugoption');
6098                 NucleusPlugin::_applyPluginOptions($aOptions);
6099
6100                 $manager->notify('PostPluginOptionsUpdate',array('context' => 'global', 'plugid' => $pid));
6101
6102                 $this->action_pluginoptions(_PLUGS_OPTIONS_UPDATED);
6103         }
6104
6105         /**
6106          * @static
6107          * @todo document this
6108          */
6109         function _insertPluginOptions($context, $contextid = 0) {
6110                 // get all current values for this contextid
6111                 // (note: this might contain doubles for overlapping contextids)
6112                 $aIdToValue = array();
6113                 $res = sql_query('SELECT oid, ovalue FROM ' . sql_table('plugin_option') . ' WHERE ocontextid=' . intval($contextid));
6114                 while ($o = mysql_fetch_object($res)) {
6115                         $aIdToValue[$o->oid] = $o->ovalue;
6116                 }
6117
6118                 // get list of oids per pid
6119                 $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
6120                            . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
6121                 $res = sql_query($query);
6122                 $aOptions = array();
6123                 while ($o = mysql_fetch_object($res)) {
6124                         if (in_array($o->oid, array_keys($aIdToValue)))
6125                                 $value = $aIdToValue[$o->oid];
6126                         else
6127                                 $value = $o->odef;
6128
6129                         array_push($aOptions, array(
6130                                 'pid' => $o->pid,
6131                                 'pfile' => $o->pfile,
6132                                 'oid' => $o->oid,
6133                                 'value' => $value,
6134                                 'name' => $o->oname,
6135                                 'description' => $o->odesc,
6136                                 'type' => $o->otype,
6137                                 'typeinfo' => $o->oextra,
6138                                 'contextid' => $contextid,
6139                                 'extra' => ''
6140                         ));
6141                 }
6142
6143                 global $manager;
6144                 $manager->notify('PrePluginOptionsEdit',array('context' => $context, 'contextid' => $contextid, 'options'=>&$aOptions));
6145
6146
6147                 $iPrevPid = -1;
6148                 foreach ($aOptions as $aOption) {
6149
6150                         // new plugin?
6151                         if ($iPrevPid != $aOption['pid']) {
6152                                 $iPrevPid = $aOption['pid'];
6153
6154                                 echo '<tr><th colspan="2">Options for ', htmlspecialchars($aOption['pfile']),'</th></tr>';
6155                         }
6156
6157                         echo '<tr>';
6158                         listplug_plugOptionRow($aOption);
6159                         echo '</tr>';
6160
6161                 }
6162
6163
6164         }
6165
6166         /**
6167          * Helper functions to create option forms etc.
6168          * @todo document parameters
6169          */
6170         function input_yesno($name, $checkedval,$tabindex = 0, $value1 = 1, $value2 = 0, $yesval = _YES, $noval = _NO) {
6171                 $id = htmlspecialchars($name);
6172                 $id = str_replace('[','-',$id);
6173                 $id = str_replace(']','-',$id);
6174                 $id1 = $id . htmlspecialchars($value1);
6175                 $id2 = $id . htmlspecialchars($value2);
6176
6177                 echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value1),'" ';
6178                         if ($checkedval == $value1)
6179                                 echo "tabindex='$tabindex' checked='checked'";
6180                         echo ' id="'.$id1.'" /><label for="'.$id1.'">' . $yesval . '</label>';
6181                 echo ' ';
6182                 echo '<input type="radio" name="', htmlspecialchars($name),'" value="', htmlspecialchars($value2),'" ';
6183                         if ($checkedval != $value1)
6184                                 echo "tabindex='$tabindex' checked='checked'";
6185                         echo ' id="'.$id2.'" /><label for="'.$id2.'">' . $noval . '</label>';
6186         }
6187
6188 } // class ADMIN
6189
6190 ?>